Sm321 is right, accounts are always recoverable, don't let the new update fool you.
With the new update system the recovery submission page is sent directly to the registered email. It makes sense this way because in order for someone to "successfully" steal your account, they would have to steal your email as well, because in order to change your password they'd need access to your email. On a side note though, there are ways around this. I've experimented with the new system for the means of protecting myself and taking safety measures if I'm purchasing an account. If you email account support with all of the recovery information and claim that your computer has been attacked (Keylog, RAT, any other sort of risk that creates information logs of computer activity), its recoverable with that claim in addition to any important and previous information on the account, depending on its validity. From experience I've noticed that accounts are recovered 90% of the time if the email or recovery request is sent on the same IP that created the account that is being recovered.
Hope this clears up any confusion, trade newcomers with caution and keep in mind that accounts are always recoverable.