Key recovery is a very old question and on a conceptual point of view has not changed for centuries:
- if only one key exist (read: only one person knows the secret), only the owner of the key can open the safe, but if the key is destroyed or lost (read: the user forgets his password), what is in the safe (read: encrypted data) is lost (*) => this can be used for personnal data when the risk of compromission is more serious than the risk of loss
- this can be mitigated by creating a second key (read: a third party has access to the secret). If the key is lost or destroyed, the owner of the safe asks for the copy and immediately builds a new copy => this is used when the loss of data is the higher risk, on when the data is essential for more than one person, for example sensitive files of an organization.
In that latter case, the hard part is not technical, but is only organizational: how can the owner of the key be confident in the third party? For web/server passwords resets, the admins can always do anything on behalf of a user, so conceptually they hold a key and can give a copy to the owner. In medium to large organizations and highly sensitive data, a common usage is to have a safe (physical or numeric) that can only be unlocked by two different keys, and nobody should hold both keys - note: this is more or less how personal safes in bank work, the bank is responsible for the key of the safes room and the owner has the key of its personal safe. For less sensitive data, a security officer can hold copies - that is the way key recovery work with microsoft encrypted folder: the symetric key is crypted twice, once with the user's personal key, and once with an administrative key to allow an admin to recover the data.
So the good question is what is your real security requirement:
- only user is responsible for its own data
- the administrator (or help-desk or...) should be able to recover the data if a user was to lose its password
- you really need two different persons to cooperate in order to recover data
The third way can be simply set up by encoding a symetric key sequentially with two different public keys, but recovery will be more complex because the owners of the private keys will have to work together.
(*) you can always try to break a physical safe, but some can be specially engineered to destroy their content in that case
Let's speak now of your actual problem. The 3 question game is a try for a multi factor authentication system. The problem is that someone knowing the person can guess the answers if they are true (and many people know a lot about celebrities) and the use can forget what he answered it he wants it not to be guessable by anybody. The best way for a user not to forget a particular password is to store it in a password safe like the excellent keypass. The analogy will be: I put a copy of all my keys in a single safe and I keep its key attached to my necklace. To avoid the loss of the passwords file, it is easy to sync a keypass on a desktop with one on a smartphone. Unfortunately it can only be used by educatable users.
If what you need is to allow the users to recover their password, it means that you have to build a copy (either on your server, or in the user's machine) encrypted with a public key for which you own the private part. If the copy is kept by the user, he will have to send it to you so that you unencrypt it and send it back. This part is highly sensitive and you could try to setup a multi factor authentication: a normal authentication and a secondary mail account for example. If the copy is kept by you, you should think about the consequences of your master key being compromised => breaks the whole security of the system.