> Would the reset request not have come to an email account, presumably a well-protected one?

Not in this case (and not in many); verifying access to a phone number is also common and apparently was an option for this bank.