They could prompt you with the security questions as some other services does for master passwords for example, but usually there's the possibility to skip it. Now I'm locked out even though I know both username and password: this is BIG logic flaw in my opinion.