High security exchange all you need to access someone’s account is access to email and reset password not even security question or 2fa