Given that security is only as secure as its weakest link, suppose I have website with additional authentication enabled in any of these ways: (example, multiple conditions may be required)

1. SMS/Voice HOTP message to a phone
2. Alternate email address
3. Question & Answer
4. HOTP soft token (Google Authenticator)
5. Printed out list of one time passwords
6. YubiKey
7. RSA Token
8. "Known/Trusted" computer (linked by an evercookie or similar)
9. Client Certificate
10. Trusted IP

Suppose a user forgets their password, most websites will allow them to reset their password if a combination of #2, or #3 is answered correctly.

**Question**

1. Assuming the user has a multifactor device and forgets their password, how should that affect the "forgot password" workflow?
2. What if the user loses the multi-factor device, or the soft token is corrupted, how should that be re-provisioned?
3. What if the user forgets the password, **and** loses the token... what should the re-provisioning workflow look like then?