I do not agree. Anyone could be hacked. Are you saying that if you get hacked it is always your own fault?
It may not be your fault, but it's still your responsibility.
There is probably just a huge back log.
Barely any accounts get recovered. As far as I know, theymos is working on a more automated recovery procedure. The last thing I read about it is that it's expected around the end of this year (I'm too busy to find the sources of this information now).
However in my personal opinion legends and especially legends that have donated should be at the front of that queue. I'm a personal believer of the more you put in the more you should be rewarded kinda guy.
I keep saying "as far as I know", but again: as far as I know, account recoveries are prioritized if theymos recognizes the username.