I recently viewed a internet security documentary on internet security and password reset methods. I was interesting and I saw the same security flaw on MM when I went to reset my password.
All that I had to do was to provide an email address and IF a person hacked into there email account they could gain access to there MM account.
Perhaps a tighter reset method could be done.
Just my 2 cents.