Password Reset Security Flaw

[Lexia]

Not everyone has a security token or a device able to use one. And a lot of people won't use a token since it's a hassle. And anyone would expect to be notified when ANY change to my account is made.

So getting a $10 token that will secure you account is a hassle? That like having a safe but leaving it open all the time cause it too much of a hassle to enter the combination every time.