If you know/guess someone's secret question you could lock their account and change their password. No other info required besides username + secret answer
Right, I didn't make the connection that frozen = locked I admit 
. However, we know that hasn't happened since the OP confirmed nothing has happened. Therefore, they haven't frozen anything. So, the whole thing from a white hat perspective doesn't make a whole lot of sense.