Err... you still don't seem to get it. Over the phone and absent a means of secondary authentication like a one-time code in an SMS (which probably wouldn't have even worked in this case, because the attacker compromised the blogger's Google Voice number), a good social engineer cannot be stopped. What is Microsoft "training" their staff to do? Be skeptical when someone answers all of the standard security questions flawlessly? Please.
The whole idea of Social Engineering is that you get staff to bend the rules and provide you with details that they shouldn't otherwise give you.
If you train the staff not to bend those rules, you make social engineering harder.
You can also make it harder by recording when attempts to access an account are made. If someone calls up three times and gets a different hint for the secret answer each time, something's clearly wrong there.
"Social engineering" doesn't generally cover the case where someone actually has all of the details needed to recover the account and then uses them to gain access.
