Yes but with IP addresses, linked-in email accounts, recovery questions, previous passwords not to mention previous membership info, the odds of finding one user that one person who doesn't have at least one of these securities is next to impossible, literally. Not to mention if you do find someone with none of these you're chances are still extremely low.