Eh same is for email. Anyone with acces to that can trigger a password recovery exchange on most sites or pass an id verification check on the stricter ones.