Normal users will probably try different question-answer combinations until they get a hit, submitting a lot of personal data in the process