But the problem is that unique passwords can just be reset by an attacker: "Forgot your password? Click here"
All they need is your email account, and they can get your email account by social-engineering the company running it.
One weak point, depending on human error (and not your own error, mind you), and they get access to it all.
How do you protect from that, plan for recovery if it happens, and mitigate the damage?
Well you can't protect from that if you only use passwords for authentication. If the attacker has access to your email account, which is what almost all password recovery schemes depend on, you're screwed, since those schemes make the implicit assumption that your email account is secure. I guess you could run your own mail server, but even then mail is not encrypted, so a sufficiently determined attacker will still get the new passwords if he wants to. At that point all you've got left is safety in numbers and not being a target. The "right solution" would be, as I said, a better internet-wide infrastructure for managing passwords or other credentials that does not rely on an insecure channel such as email to reset passwords. But email is one of the few technologies that:
a) has existed for decades
b) is near ubiquitous
c) just works
Which makes it an ideal medium for centralizing various critical management tasks on behalf on the user.
As for recovery and mitigation, again, it partly depends on what the website in question has in place to handle this. For instance, in the case of banks, if you get your account compromised, there are - ideally - tons of heuristics that will put your account on lockdown if suspicious activity is detected, which can only be resolved by a phone call or other difficult-to-impersonate procedures. But a random website is likely not to care at all, after all, how do they know you did get your account compromised and aren't just someone up to no good? Unless they have some way to verify your own identity, you could be the attacker for all they know. Security questions tried to do this, but it doesn't work.
And, of course, yourself taking quick action can always help, rather than letting the attacker roam free with your account and doing as much damage as possible. For instance, sending a PM to a moderator to get him to temporarily ban your account until the situation can be resolved, etc... there is no one mitigation approach that will work for everything, ultimately you need to convince the website that your account really was compromised and that you have regained control somehow.
But the bottom line is, if you only use a password, the attacker can reset your passwords, and can also read the new passwords, you've simply lost. There is no security at all to be had in that situation. Your account is his in every way that matters to the website.
FORTUNATELY, we know that passwords and in general "what I know" challenges are not the only way to authenticate yourself to a website or other party. There are two others: "what I am", and "what I have [physically]". The first option falls into the category of biometric signatures, which obviously don't work too well over the internet, so these are usually used when physical access is already implied, and where high security is required. The second one is more promising, since it's about things like credit cards, security tokens, actual keys, which are hard to replicate, hard to steal, and relatively easy to track.
Websites which implement a login procedure requiring both a password ("what I know") and a challenge based on "what I have" are said to support two-factor authentication. For instance, websites might have a little smartphone app that requires a one-time secure setup (which presumably the attacker is not around to snoop on of) and then outputs short PIN's in sync with the website itself (with no shared state) which means an attacker cannot login with just the password, but also needs the valid PIN at that moment in time. Which means that to log in, he must acquire physical access to either the website's servers (at which point he has everything either way) or yourself, making it more secure than a traditional password-based system.
Two-factor authentication is becoming more common, but is not really standardized, so it's kinda hard to make it work properly without inconveniencing (or straight up alienating) users. But I think it will become better in the future, and that it is the future either way. Information-based security is not sufficient in the face of side channel attacks such as social engineering, at that point you really need another layer of security (be it two-factor authentication or something else). We're not quite at this stage yet, but the entire security infrastructure of the internet is in a rather precarious position currently, and it doesn't take much to completely subvert it given the opportunity (as you've noticed).
To conclude, though, never forget that we are imperfect humans living in an imperfect world, and that complete security is a myth. It all boils down to how secure you need to be relative to how much you are willing to pay or do to to achieve that goal. In other words, how valuable you are.
