Security questions considered dangerous

As I'm wrapping up the security chapter for Essential ASP.NET 2.0, I'm putting together some guidance for using SqlMembershipProvider. One of the things that really bothers me about this class is the ease of which one can reset a users password by answering a single question that the user specifies when creating her account. There's nothing stopping the user from asking a question that is easily answered by a 6 year old:

What's 2 plus 2?

Or even a question that's easily answered given some public knowledge about the user:

What street do you live on?

Or something you could easily find out from a user by asking her:

What's your favorite color? What's the name of your dog?

I find it ironic that SqlMembershipProvider goes to great lengths to allow you to control password complexity, and yet still allows that password to be reset with a simple question/answer challenge. Sure, you can turn off the password reset feature, but that's not necessarily optimal either. What would be great is if we could replace the question/answer challenge with something better, for example, the system proposed in Building Secure Software by Viega & McGraw. In Viega's solution, the user doesn't get to write the questions - the system designer comes up with a long list of questions, asking the user to pick M questions and supply answers. Then at password reset time, we randomly choose N of those questions and ask the user to answer at least P questions from that list. M, N, and P would be variables you control based on your security posture (risk tolerance versus ease of use).

PayPal, for example, follows this procedure:

1) You must choose an email address that PayPal already has on file for you. Password reset instructions are sent to this email. The form includes CAPTCHA to detect bots.

2) Once you get the email, you must click through a link to access the password reset page. As with virtually all pages at PayPal, this runs over HTTPS.

3) The password reset page asks you to choose from several categories. You can either verify your full credit card number, your bank account number (if you've linked a bank account), or you can answer a couple of security questions.

PayPal currently offers four security questions, and you must supply answers to two of them. The questions they offer are as follows:

Mother's maiden name, last 4 chars of drivers license, last 4 numbers of SSN, city of birth

I'm curious how others are automating password resets. It's an important feature, as password reset is one of the top reasons people call a help desk, but it's also a tough problem to solve.