cPhulk - seeking API or script to manage support for users forgetting PWs

More than half of our support tickets are due to blocks by cPhulk and CSF/LFD.
These firewalls are a good thing, however we want to lessen the frustration for both us (support) and client when a block occurs.

Do people have any solutions for:

1. self-directed "healing" (a challenge question so the client can interactively reset the block)
   
2. detection so we(and hopefully the user) can quickly identify that a block is what the problem is (and then we can manually unblock them)
   
3. APIs so we can one-click (in our support site) unblock them in CSF or cPhulk.
   

We have a JS script on our support page that is pretty good at telling both the user and us if they are CSF-blocked (sometimes it can get confused if the server is inaccessible due to DOS attack or datacenter problem).
But we don't know any techniques/snippets to discern a cPhulk login block.

The best case would be a (logged-in) cPanel way to do this (granted CSF-LFD wouldn't let one get to the server to begin with)

Advice anyone?