This is gobsmackingly awful. Their 'relax we won't let people use this to hijack accounts on other services solution is to check incoming email for a new header. a new header that yahoo invented.[1] good luck getting every web based sign up site with email password reset to update their email service.

1. http://www.wired.com/threatlevel/2013/07/yahoo-email/