Wow that is crazy!
Now they have to make darn sure that the requestor is the owner of the account.
I understand why they're doing it, even if I don't like it much.