All the fancy 2FA and questionable security questions aren't going to help if admins are going to bypass them based on a phone call. That is a massive, massive security hole.

And with so many services potentially tied to your email address, this can amount to identity theft. Maybe the caller and the admin circumventing security for them should be getting some legal trouble for this.