One thing I've done on some sites that seems to work well is to allow two different email addresses on file all the time, and to contact both in the event of a forgotten password. IT's rare that someone loses access to their work email and ISP/Yahoo/Hotmail/GMail at the same time.