I recently viewed a internet security documentary on internet security and password reset methods. I was interesting and I saw the same security flaw on MM when I went to reset my password.
All that I had to do was to provide an email address and IF a person hacked into there email account they could gain access to there MM account.

Perhaps a tighter reset method could be done.

Just my 2 cents.