All the fancy 2FA and questionable security questions aren't going to help if admins are going to bypass them based on a phone call. That is a massive, massive security hole.
And with so many services potentially tied to your email address, this can amount to identity theft. Maybe the caller and the admin circumventing security for them should be getting some legal trouble for this.
But then get someone with your name that gets a support tech at your email host that's willing to reset the password for them, even worse bypassing any security they have, and then you're going to have a bad, bad day.