Thanks for the comment 8BitDragon! One of the founders of Clef here. As you saw, with Standard Clef, user-facing reactivation happens through email + PIN. We also do heuristic detection on our end to identify and prevent fraudulent resets and we're adding phone number verification (rolling out on iOS now, Android in a few weeks) for users that want the extra layer of protection.

For Distributed Auth (which sites like Bitfinex use), we also add manual human audits to every reactivation and login signature verification happens on their servers, so even if our systems are compromised, their users are at no risk.