But then, email always was the only authentication. On any site, click "forgot password" and promptly they send you a reset password link. Very few sites have a challenge question.

Could be worse, I still sometimes get my password emailed in plain text by companies when I do that.