A simple social recovery method of 3 contacts approving could lead to mass takeovers if the attacker gets a hold onto multiple accounts. Often, a group of say 3 attacker controlled accounts doesn't just have one friend in common but multiple. As long as the graph is 3 connected and the attacker starts out with a group of accounts that can take over one more account, the attacker can take over the entire graph.