a memorized password is not part of a well thought out recovery flow.
double triple emphasis on "memorized"