There's a recommendation that security questions are quite weak for keeping accounts safe (it's why most places have multiple and why a lot got replaced with multifactor authentication).
I had a brief skim through the seclog and haven't found much over the past week of many resets actually being done so it's probably just an unsolicited piece of advice.
Okay I had disabled the question a while back. but I guess it was showing as active to admin as this account had red type saying to delete it.
my alt had nothing.
as I said password was not altered. I will keep an eye out for issues with this account.