It might be nice for an admin to fashion their own Challenge Question, when a user is trying to revise their old/existing email address via the new Email Recovery feature.
That would require admins to also create custom PHP code to go along with their criteria, I'd have to consider the best way of doing that (e.g. code event listener vs custom PHP callbacks).
The other problem is, just now I make assumptions about the IDs in the criteria table since there's no custom criteria, I would need to change the way criteria are identified to a "varname" based system if I was to allow custom criteria so as to avoid such conflicts in the future.