This question already has an answer here:
My friend is receiving a lot of Stack Overflow account recovery emails. When I checked I came to know that for triggering account recovery only email id is needed. So anyone knows his email ID can send a recovery email to his inbox. Since email ID is something public should we ask some private info like date of birth before sending account recovery email?