Nothing is 100% foolproof. Many sites I use allow a request to reset the password without any challenge and an email shows up minutes later. Until someone gets burned, computer security rarely gets an afterthought.