Situation has been like this for a long time. I simply don't understand why more people do not recover accounts ?
Because there's only two admins with the power to do so and they are both swamped and don't have the time to look into everything that needs sorting. It's a shit situation but only theymos has the power to do something about this. I've told him that he should either promote someone else to admin or consider paying himself a reasonable wage and do admin duties full time because it's badly needed.
Even better why forum doesn't have any security features ? 2FA might be hard to implement on old platform but I mean at least require email verification before password change. Is it that hard to do ? I can personally code that in less than half an hour.
Some sort of 2-factor is also badly needed but I get that there's not much point implementing it on this forum with the new one in development (though if the new forum is still 1-2 years away still it probably should be put into place here in the meantime).