Mentioned in [55397] on Core SVN:
Recovery Mode: Use PasswordHash API directly when validating keys.

Created ticket #56787 on Core Trac:
Recovery mode tokens can't be validated successfully if pluggable ...