HW reports that the creator of the accounts has been identified, and used an exploit to create the accounts. However, the recovery account being a feature of accounts created upon creation is a useful thing to remember, and I very much appreciate your sound counsel.