Given an account reset procedures, there are usually some recovery questions, and in better implementations a link will be sent to confirm the password change via email or SMS. Therefore, the attacker needs both information and access to use the password reset mechanism for an account takeover.
These controls are often very useful against some random attacker on the Internet, but I want to focus on when a family member is the attacker (e.g., parent trying to get onto child's account, boyfriend/girlfriend trying to get access to partner's account, etc.). In this scenario, the person is very likely to know the answer to any personal challenge questions (mother's maiden name, first car, third grade teacher) and is also likely to have physical access to the victim's phone or PC. Let's also assume that the victim is not a security minded person, so they leave their email open in a tab and does not have a screensaver password and their phone is protected by a pin which is their birthday.
As a security guy, I always put in gibberish for answers to security questions and store the answers with encryption, but since the victim doesn't really want to deal with a password manager, doesn't know what encryption is, etc. we cannot rely on the user taking countermeasures to protect him/herself since the victim may legitimately need to use these answers to recover his/her account.
Knowing that there is the physical security issue and that information is not well known, what countermeasures or controls can the service provider implement to help protect the user from an attacker who is a family member/friend with physical access.
Answers should be on the service provider side, since the goal is to protect an unsophisticated end user.