The treatment of recovery address has been explained in our Privacy Policy: https://proton.me/legal/privacy. From a technical perspective, one can't end-to-end encrypt a recovery email as it needs to be accessible to send the recovery email, which is typically initiated by an unauthenticated user who has lost their password.
