What is best practice for a forgotten login email address?

It seems as though all the major sites that use an email as a login only allow for forgotten passwords. Looking to find how users can recover an account when they have forgotten their login email.

At the moment I have a link to a page that allows 5 attempts and after the 5th failed attempt they can make contact with a person for verification. Is there a security issue with this?