Your idea of changing the order is good, because the additional question could be used to avoid sending unnecessary password reset messages just by typing in the username or the email address. The security question is not there because it's secure: their nature tend to be easy to answer after researching the target. That's why the order matters for other reasons.
If you use email addresses as login names, they are bind together in a way that makes it easy to know where the information needed to reset the password goes. That's not generally dangerous to every user, but on a large pool of users there may be someone who's vulnerable. Also, if the email gets compromized first, it may be used for resetting passwords for such sites. In this case, two factors isn't much.
There's all kind of variations, but the factors should always be independent: something you must know and something you need to have access to. Using both email and SMS adds extra level of security, e.g.
- Ask security question to launch the process.
- Email one-time link to a password reset page.
- This page, when accessed, sends a code to the phone.
Nowadays it's common that people have their email on their phone. Having unlimited access to someones phone gives ultimate power over two of these factors: email & SMS. That's why security questios aren't completely pointless even if they don't add a strong layer of security. The phase 1 possibly prevents an unlocked stolen phone from being used for a password reset.