Locked out of Apple ID AND lost Recovery Key for two-step verification

Question

Hey guys,
Firstly, as the title implies, this is a double-whammy of a problem, and obviously, it is very much my fault. The reason I'm bothering to post this, however, is to find out if anyone else has had this issue and where they are at with it.
The story:
I set up two-step verification on my Apple ID about a year ago as I thought it was a good idea. I wrote the Recovery Key down as it told you to, and put it in a folder full of other important documents. In a epic mental lapse, however, I now remember later throwing out that folder, forgetting about my Recovery Key. Ya, that is my fault, I'm and idiot. Anyways...
Fast forward to a few days ago, and I all of a sudden received messages on all my devices saying that my Apple ID had been disabled for security reasons, and that I had to reset the account in order to regain access to it. Scary, but no problem, right? Well, after entering my Apple ID into iForgot.com, the first thing it asked me for was my Recovery Key. This is around the time I was banging my head against the wall in realization that I had thrown it away, but I was relieved to see the "Lost your Recovery Key?" option at the bottom of the screen. I was even more relieved to discover that I had what I needed to reset it: my current password and a trusted Apple device. The catch was that to reset it, I needed to log into my Apple ID to initiate it, which of course I couldn't do because it had been disabled, and the only way for me to disable it is, again, to enter in my Recovery Key. This effectively put me in and endless loop, without any apparent way of gaining accesses to my account. I did contact Apple about it, and I was ultimately told that the lock on my account was so tight, that not even Apple could gain access to it.
I understand that this level of security is probably the whole reason for the two-step verification in the first place, and I again concede that it was extremely foolish of me for forgetting about and discarding my Recovery Key, but a few things still don't make sense...
1. Why would they put a "Lost your Recovery Key?" link on the password recovery page when a password is needed to reset the Recovery Key itself?
2. As far as I can remember, Apple, in their briefing of how two-step verification works, did not bring up this scenario, which is probably relatively common. They DO mention that they can't help when you don't have access to two of the three necessary things for recovery, but they never brought up the apparent exception of if the account is disabled, in which case having two of the three things needed is not enough. I don't understand how they couldn't have mentioned this scenario.
3. Given the above thought, how could Apple not have some sort of special contingency for this type of situation? I profess my ignorance of how these types of systems are set up, but I would feel that there should be a special method for recovery in place if the account has been locked, and the owner is able to verify that they have the password and trusted devices.
I didn't mean to make it sound like a rant. I ADORE Apple, but this system seems like it's less than perfect.
Has anyone else ran into this issue? If so, is your situation similar to mine?
Thanks for any response!

Answer 1

Hey everyone.
It's been awhile, but I wanted to share with anyone who is interested some general knowledge about this issue that I have learned while communicating with Apple support. Unsurprisingly, the issue is still unresolved, and I am under the impression that it will remain that way, but I'm still trying to get in touch with one of the senior representatives I spoke with a while ago who seemed to think that there might be a solution, so I suppose there is still a chance that things could turn out for the better.
Here's the rundown:
Anytime you are unable to sign in to or access your account because of "security reasons", your account is under what is called a "DS Lockout".
A DS Lockout on an Apple ID can be triggered for a few reasons, such as when too many failed logins to the Apple ID (using an incorrect password) are attempted, or when a purchase is made that Apple believes to be fraudulent.
Under normal circumstances, a DS Lockout only lasts for 8 hours, after which the lock is lifted and access to the account by inputting the correct password is re-enabled.
This is where the catch for anybody who set up two-step verification is.
According to one of Apple's security representatives, IF you have two-step verification enabled upon being inflicted with a DS Lockout, the 8-hour lockout period is extended indefinitely as an additional security measure (a feature, I suppose). Therefore, the only way to regain access to the account is by resetting the password, as waiting for the lockout to expire is no longer an option. And of course, resetting your password, as stated by Apple, is one of the situations in which you need your Recovery Key. EVEN IF YOU KNOW WHAT THE ACCOUNT'S CURRENT PASSWORD IS, the lockout prevents you from being able to input it as a means of authentication. You MUST reset your password in order to regain access, and you MUST input your recovery key in order to reset your password.
So, that seems to be the gist of it. It does make sense, but here's my problem:
Upon setting up two-step verification, Apple does warn you of many things, but they do not make any mention of this specific scenario. Indeed, it is very much my fault for loosing my verification key, but the thing is, I’m human, I make mistakes, and I know that I will continue to do so. One of the reasons I chose to take the risk of setting up two-step verification is because Apple explicitly stated that as long as I had access to two of the three required "keys" -- my Recovery Key, my password, and at least one of my trusted Apple devices -- I would always be able to gain access to my account. In other words, as long as I didn’t screw up so bad as to loose access to two of my keys, I’d be okay. Obviously, there is a huge exception to this case that, again, is not mentioned anywhere, hence all the confusion. Had I know that it was possible that it could come down to me needing a single, specific key to regain access to my account, I probably would have opted out of two-step verification, recognizing that as a busy college student who's constantly reorganizing and dealing with tons of forms, worksheets, and other various documents, it's not as easy to hold on to a slip of paper as it might be for others. I'm hoping that at some point, Apple adds a big, red warning to the setup process which reads something like:
"In the event that your Apple ID is locked due to a detected security risk, your Recovery key will be necessary to regaining access to your account; knowing your password and/or having access to any of your trusted devices will no longer be enough."
I really do appreciate how seriously Apple takes its security, but I think that there is still room for improvement. This should start with more clearly and fully stating the conditions of its security measures, as well as having its customer support be more educated on these conditions (they themselves stated that they had never been trained on issues revolving around two-step verification). Protecting someone's private information is important, but so too is making every possible effort to ensure that customers can't easily loose access to all the content and services that they have spent much time and money building up and using.
As stated above, I'm still trying to get a hold of the Apple representative who initially assisted me, so if I have any additional updates, I'll be sure to reply to this thread. I hope that anyone who is going through the same issue, or is simply curious, finds this information to be useful.