iCloud forgotten password with @icloud email

I have a relative who has quite the predicament (this is not a device on my account - logging here, because she can't for obvious reasons):

1) The iphone that she has (and has just had to replace) is having intermittent networking issues.

2) She has forgotten her appleid password, and the only device that is still available and trusted is the previously mentioned iphone that has issues.

3) When we try to use it to reset the password, it goes into the 1 hour lockout - then when the hour is up - another 1 hour locket, etc., etc, etc.

4) So, now that she has a new iphone - we are trying the reset my password through that phone. It asks for the phone number - and we are able to respond to the code that it sends to that phone number - great!

5) Then, it insists on also sending a code to the email address - which happens to be an @icloud address.

Can you see the problem here? She can't remember her password - so she can't get into her @icloud email to get the code to allow her to get a new password. Insanity is ensuing.

We are going through the 24-hour+ route now to reset security - hoping that there will be no more of the chicken and egg issues there.

Does anyone have any ideas? And - more importantly - could someone pass this along to the folks that design this security? Perhaps require that someone who insists upon using their @icloud email as their appleid also have a recovery email in place so that there is a way to possibly get there from here.