Agreed it seems over the top in this instance.
Fo resetting the password on a miles and more account when you no longer have access to the original email address (for example) they absolutely should be taking these kind of precautions. For delayed baggage claims, it seems surprising that this is necessary.