Almost all services have a "forgot password" link that will send a reset to your email account.

The solution in this article isn't really "relocating" the attack... more like removing additional attack vectors and limiting it to the email vector (which already exists right now, anyway).