1. Force users to register two U2F tokens. Google's 'advanced protection' requires this.
2. Have users print out one-time-use recovery codes and put them somewhere safe. This is what Google does without 'advanced protection'.
3. Require the user to provide a cell phone number, thus offloading the problem to cell phone companies, introducing all the insecurities that result from that. This is what Apple does (as far as I can tell)
4. AWS is similar, but requires both an e-mail and an automated phone call.
5. Github delegates 2FA recovery to Facebook, via their "Recover Accounts Elsewhere"
6. Facebook allows the user to designate 'trusted contacts' who can get a code they can give to the user in person or over the phone.
7. Have the customer contact customer services, who follow a process companies are cagey about disclosing.
8. In corporate settings, just have them visit helpdesk in person.