Does Apple do in-store password resets? I'm thinking with their retail presence this would be a good solution. If you want your password reset come into the store with a photo-ID and the physical credit card on your account. Doesn't get much better than that. I realize not everyone has an Apple Store nearby but many do.
"I realize not everyone has an Apple Store nearby but many do."
That could be a handy additional service to offer, but they'd still have to provide a non-in-store method for all the people who don't, so it wouldn't be any more secure.
Whenever you do a password reset their is a possibility that it was performed by an attacker. However much you check their identity this will always be a risk. Therefore it makes sense for Apple to try and contact the user via several different methods. Call them on the phone, send a letter etc to inform them of the password reset. It must originate from apple, and be out of band. Having people go to the apple store does not achieve this.
