Damn, it seems I really dodged a bullet here. I was recently asked for security questions logging into a company account (iOS management account). Whoever created the account only jotted down the answers to two of the questions. It asked for precisely these two, and I was able to change the other without answering the third..