Check it yourself if you have a personal account, go to forgot password, enter e-mail address, and guess what....you change password just by entering: a) Your house no. OR b) Your phone no. Both can be obtained damn easily. Just saved myself by modyfying them completely. Suggest you to do the same,
So how will the hacker get to know your phone no's until and unless he knows everything about you, lol?
First of all, nowadays whatever job you do you usually have a website, my friend created web graphics and had his phone. no on his site, i got access to his account easily. But we were friends so i told him to change it. Secondely, n00bs on internet will easily sign up on your site to get paid $1 and you can ask them their phone no. in your sign up forum and address too, if they enter correct(which they usually do if they want money) you cna get back your $1 plus any extra they have.
Sometimes when you send money to someone's account Your phone number would be visible in the senders receipt in his/her paypal account.. This is a real security risk I think EDIT:I checked it ... they are sending you a mail to reset the password and after that they are asking the security questions .. so it's not that easy I think.. but really they have access to security questions..