If it is an anonymous account (identified only by a made up user ID and password), then that limits options. If a user supplies credentials when creating the account, including a valid credit card that ties back to the individual, then later on when a reset is required the user can open a paid support ticket with a credit card (either same one, or another one in their name).

If a user is more paranoid, they can select the list of recovery criteria at MFA creation time. This can include the common method of charging the card, submitting two small amounts (less than a dollar each) in the user's bank account and having the user report those amounts back, followed up by a physical letter with a reset code. All of this gets paid for by the initial credit card charge ($10 would be reasonable for many people).

Also, have the option of registering more than one MFA.

As per the post, this policy change only affects free users (so, users who aren’t using a credit card to pay GitLab).

They also do support multiple FIDO2 tokens as well as recovery codes.

Right, what I was proposing is that even a free user should be able to (optionally) provide enough identifying information when setting up MFA. Then upon needing a reset, that would be a per-incident charge.