This is true, I have experience to use this feature in the past. I can take over user account just because they are put a real jobs in his life. Of course what i do just for security reason not for hacking. So i told him to deactivate the feature and change it to use SMS verification in case he lost his account. Secret question has limited answer, when we choose the name of family someone can know it, using jobs, someone also can find it. So if we want to safe from hacking. if we put a fake information, we can forget about it. That why i never activate any secret questions again.