more fundamentally, the idea of being able to reset passwords like that is kind of insane. I'm a fan of one of the paypal models- they verify credit cards by sending a unique verification pin to the registered billing address. Not saying that would work here, but it's a nice example of mixing online and real world, and institutes a time lag.
For most users, the idea of that kind of password reset is convenient. And it's not easy as you claim nor practical to regularly check the existence of alternate emails, especially with the amount of users Gmail have. And by the way, they already have a new feature wherein you can use your mobile number to retrieve a password reset code.
There is a feature in Gmail where you can see other currently and some previously logged in sessions. Perhaps it can be made more visible to the user, but it worked for me and had actually used it once to halt an intrusion (not really hacked, my password was automatically saved from another computer's Firefox).
Lastly, another feature that makes me feel safer with Gmail is HTTPS and the ability to force your session to HTTPS whenever you log in.
It's pretty highly visible, especially when more than one person is logged in at once - it's highlighted you bright yellow. It's a brilliant touch - I check this every once in awhile, but have yet to find anything.
A free Hotmail account becomes inactive if you do not sign in for 30 days, or within the first 10 days after signing up for an account. Once an account becomes inactive, all messages, folders, and contacts are deleted, but the account name is still reserved. If the account stays inactive for a further 90 days, it is permanently deleted.
I'm almost positive that the account I had to recreate was no more than 6-9 months inactive.
That sounds completely irresponsible.