Users who forgot or do not have access to their alternate email or lost all details of alternate emails or never updated their mobile does not mean they are not he right persons accessing the account. When there is doubt you can always have some ways to allow the user to change these details. Only way you guys got is some stupid form asking for details stored in your Database which may not be correct as user might not have the provided the correct ones at the time of registering and now might not be remembering what details he/she provided. Also even if the details are correct, user might not remember the subject lines or the emails ids of the recent mails. No body ever remembers such things, that does not mean he/she would not have access to their mail account. Also that does not mean he/she is not the right person. At least allow the user to go in and make changes. Force these stupid rules only for the person/persons who are reporting of any hack or spam or id theft.
A sorry felt, dejected, disgusted user of hotmail.