That's one of the ideas we have. However what about people that didn't set their PIN? Someone evil could set a PIN and then the real owner wouldn't be able to payout at all. The only way they could prove they're the owner then would be signing a message using an address, but most people have no idea how to do that (and some people use exchange addresses, where they don't have access to the private key).

I believe that the only sane way is signing messages from the very beginning. That way only real address owner can change the threshold. If the owner can't sign a message, they'll be stuck with the default lowest-possible threshold (which isn't that bad, at least they'll get the coins).