If you receive an email from ANY company asking you to provide personal information, including security question answers and the like, it's probably phishing - contact the company directly. We will never ask you for this information.

My friend can't access his account anymore, he reset the password twice and it still says "Invalid E-Mail or Password". He contacted mojang and it's been 3 weeks since it was sent.