Well, as far as i can tell this isn't exactly their fault. I'm assuming that they'll actually be installing their own servers in a data center instead of renting a VPS at OVH...
I'd be surprised if the top level package offered by OVH allowed for password reset without some kind of verification. We've had this situation before where it turns out that hosting services had available top tier packages but Bitcoin services were using lower tier packages meant for less critical operations.
It
is the fault of service providers if they choose hosting services without knowing that a password can be reset without verification. That's the kind of stuff you research before you choose a provider.