This is not a traditional token use-case (as you would use for e.g. a password reset email). We're talking about long-term identity keys (the account key) which are associated with authorizations for FQDNs, giving the owner of that key the ability to issue certificates for those FQDNs. The risk is not related to any kind of token, but rather to losing the long-term identity key, which really is no different from losing credentials for a more traditional CA (who can re-use these authorizations for up to 36 months).