Hi
I agree that using an obscure answer and question (not always allowed) is a great approach. It also makes sense to use a deadend email that is not setup for reset. Eventually you might need to send a letter and proof but all s protected. Plus you can create one that can be very specific and also use a local doc store to hold it's value with a reverse obscure reference.