Since when are cd-keys no longer a valid way of proving ownership of an account?

My friends and I last played rift about 2 years ago and we recently restarted when it went F2P.

Myself and my other friend managed to get our account back just fine, the third one didn't know his password or the answer to his security question anymore.

After queueing live chat for a few hours, he finally managed to get in touch with a customer support employee.

The thing that baffles me are the questions that were asked:
  1. Please provide the answer to your security question
    • If he knew the answer to this question, he would've reset the password himself don't you think?
  2. Please state the date of when your account was first created
    • The employee said to look for the e-mail that was sent when he first created the account.
      Who on earth keeps "Welcome to bla bla bla" e-mails? I know I don't and there are probably many others who don't either.
  3. Please give the last 4 numbers of the credit card on file
    • My friend doesn't even have a credit card! I'm the only one out of us three that has one. And if it happens to be my credit card on file, it has been scratched atleast 2 times over the past 2 years because I lost it. So i wouldn't know the numbers either.

Now, my friend was able to provide the following:
  1. The CD-KEY that was used to create the account
  2. The characters currently on the account (we still had them in our friends list)
  3. His real name (duh -.-)

I even opted that we'd sent a photo of the retail rift box with the cd-key inside of it, but support seems NOT read the support tickets completely and just post random, standard "solutions"

Has anyone ever had a similar problem?