“it’s better to get locked out of your accounts by your own doing than by the actions of a threat actor”