Isn't that a problem with phone-based email and apps already? For example, how many people have their email set to ask for a password each and every time and who has the facebook app set to ask for a password each launch? If I had someone's mobile phone, I could easily use the "forgot password" link on most web services and then just pull up the email client.