Oh man I just had a thought. If they require an ID for auth, someone at the news agency has to validate their ID. If that person gets fired, and decides to use their ID to validate ownership and change the password on the account, malicious activity ensues.