How do you propose we do this without a user email or phone number? Or do we require an email for this? Or phone number? Or do we say "it's optional if you want to reset your password?"