A password reset closes the front door, but the attacker is keeping the recovery key to the back one.