Possibly add a security number as well, that you have to use with
the username & email to unlock your id. Email can sometimes be
easy to get to, so a little more security doesn't hurt.

Auto unlock accounts after x amount of days or prune them.