Basically, users are not quite fond of protecting their accounts by not using a security question, that, is the very best assurance of security you can have in forum. And most of the hacked accounts as you can see are those accounts for sell, without having escrow, if i am not mistaken.
Actually most of the hacks are coming from "Secret Question".
If you dont have "Secret Question" and want to change email or password, forum will send you email notification to approve your request.
But if you have "Secret Question" , it will ask it, then the hacker have unlimited tries/retries to guess the answer and change your email and password.
Mine got hacked by my "Secret Question" .
Secret Question:
To help retrieve your password, enter a question here with an answer that only you know.
Using this feature is not recommended. Anyone who guesses your secret answer will have access to your account. It's like a second password.