If you are super duper serious about securing yourself, recovery email is non-viable. Every piece of data is a potential vector towards exposure.

Which comes directly into the problem of security vs convenience.