Bootstrapping identity without an existing identifier to base it on is a difficult problem.

On one hand, it is a barrier to entry. On the other hand, without some barrier, you can be subjected to spam.

One option to deal with it is Web of Trust, with users who have been vouched by the operator being able to vouch other users, and so on.

So, if I forgot my "password" (private key), I can log in with a new key, and say, "my name is Joe, please verify me", and confirm it via out-of-band with another human.

If you have access to at least one device with a valid key, you can vouch the new key with an existing one.

And if any improper vouching is detected, you can trim the vouch tree at the problem node with all downward nodes also becoming disallowed.

This is basically the (PGP-based) account system I've built in sHiTMyseLf.