I visited my bank's website today with the intention of logging in to do bank stuff. I entered my username and hit enter on accident without entering a password. It took me to a page to select how I wanted to get my security code in other words the forgot password page. I selected my phone number to call me and upon entering the verification code, it took me to a page to reset my password.
I assume that many services implement a model similar to this but it seems fairly trivial to find a situation where someone used some sort of publicly accessible computer, whether that be at a coffee shop or some sort of work environment, to access their bank account and let the browser remember their username. Acquiring the phone might be a little more tricky but not impossible and because it is a phone call I don't need to know a PIN number to get in, I just have to be able to answer it when it rings.
Wouldn't an email with a password reset link be a better model?
Maybe I am oversimplifying the complexity of the problem, but it doesn't seem like someone with questionable motives would have to be that ambitious.