Sort:  

The process consists of two independent blockchain operations, one signed by the recovery account, one by the stolen account owner.

Good to know. I was wondering if I was getting it wrong somehow. So the person who had their account stolen simply posts a new public key to the blockchain (and old private key) and it's up to the recovery account to verify that is a valid request by the correct person? Pretty smart.

Sometimes I write these pointless posts just to lure you smart people in here to tell me how it actually works :D

.

How can the process begin with the recovery account? Doesn't the account-to-be-recovered need to make a claim first? Does this happen off-chain?

.