Answer
An attacker may bypass the strong login through weak recovery channels. Update recovery methods, limit who controls them, and test the account recovery process.
Explanation
Security is only as strong as the easiest supported path back into the account.