I remember
Hilariousandco(Global Mod) saying that Cyrus once mentioned that account recoveries are a hectic task, and a lot of investigation is involved. These account recoveries consume a lot of time,apparently. Since only 2 people can investigate and their time is very limited, so a lot of issues just exist and nothing ever happens.
I think the process is even simpler for data-centered websites like facebook... I wonder what investigations can possibly be involved apart from checking the IP logs. IP Logs along with verification from the oldest staked address should be enough. The problem is, this process isn't automated and 2 admins have to process this stuff manually.