I happen to be an Air Force Reservist, and our policy within the Network Control Center is, "If you know the person that you are talking with, you can change their password over the phone, else they have to come to the NCC and show their identification". While the base has several hundred people who work there, after a while you get to know most of them, as they are the ones who constantly have all sorts of PC problems.