- The owner permission is set to multi-sig with 3rd party 2nd factor
- The owner permission can also be configured to be controlled by the eosio.recovery contract
- The eosio.recovery contract will allow you (or your friends) to change the owner permission if the owner permission has been unused for 30+ days, but first you must wait 7 days during which the owner can cancel.
If you are hacked, then you work with the recovery partner to restore your active permission. If you lose your password then your recovery partner(s) can change your owner with proper delay.
The only time you are out of luck is if you are hacked and lose your key at the same time. In this case the hacker can keep your account active (preventing lost password recovery) and you are unable to co-sign with your recovery partner.
If you use hardware wallets, like Apple's secure enclave with touch-id then this last scenario is significantly less likely unless the hacker gets your fingerprint & phone.
You can combine all of this with paper wallets for the truly paranoid.
Furthermore, the multi-sig with the owner links to your recovery partners active permission. This means that they can also be recovered by someone else. This creates an interconnected web that requires the simultaneous hacking of the full graph to permanently gain control of accounts.