saying when the account was created (month and year)
This is an absurd requirement, but do you have a ballpark idea, and does it let you continue to guess multiple times? Submit a few dozen password reset requests and if they complain, tell them to verify you via alternate means.