Done in 0.6.85. Now there is a setting: "User policy->Allow account recovery by email" - just disable it.
