Salting passwords can help, so even if someone gets in database, they aren't getting the plain passwords.
Ragnorak: I understand, standard security questions like mother's maiden name or name of first pet tend to be duplicated across different sites, so can be a security risk if one site is compromised. Here at 2wap we take a different approach by asking users to invent their own security question, and advise them to make it one that only they will know the answer too. I appreciate it still isn't flawless as some members may choose their question or answer thoughtlessly, but this is their responsibility and we need a way to verify users for a new password if they don't have a valid email address. Also databases can only be hacked if there are security flaws in the coding, but we are careful about such things here.