Also, having a security question can stop people from people from changing the passwords of others. Something simple, or even asking for the date of birth if you want to ask for that when they sign up.