If you have any kind of non-tech savvy users, it's a terrible practice, as you would be flooded with support requests on how to get into their accounts with no way of verifiying the actual owner.