Likewise. Social engineering is a big concern. I understand the risks of getting locked out of my account, but would much prefer a stricter system -- along with published guidelines on Fastmail's process for handling these cases.

Being able to persuade a customer service rep to provide access to an account (even if indirectly by changing a recovery email) should never be possible.