So, this is Theory only.
While poking around on a old Eve Online account, I noticed something that they did for account security. They asked for the player to enter a old account name, password, the standard crap. Then once that is done, they ask for you to type in the name of a character from your account.
Coarse, that was me trying to activate the incorrect account, which happened to be a old trail account that I ditched a few years ago. But still same idea.
Now with that said. It could be something Blizzard should adopt to add another layer of account protection, because it appears Account Hackers are going and hacking old accounts.