I have searched and viewed most of the other questions and answers about implementing forgot password functionality on a website.
However, we have a unique situation. When a user registers an account and uses their company-based email as the main email account, how can we implement a forgot password scheme if they no longer work for that company and can't access that email account?
We currently send an email with a reset link to their primary email account. Most do not have a secondary email address and we do not want them to be able to enter just any email address to send the link to.
Is there a design pattern whereby we can have the user enter some information and be taken to a page where they can be allowed to change the email address to send the reset link? BTW, we do not want to use/store security questions.
How has this kind of thing been done before? I don't know of any sites that do this because most of them require to send an email to the user's account.