Jeremy Dalberg, Ultima Online Community Director, outlines the details here:

UPDATED 11:55AM PDT - Added a final step to the process for clarification.

In order to add an extra layer of password security, new accounts are required to choose a security challenge question and answer. However, existing accounts can also add this - and we strongly recommend that all our players do so. Instructions after the jump:

To add a security challenge question to your account, please do the following:

- Visit the Account Management page.

- Select "Create Account." (Yes, this is counterintuitive.)

- Select "Already have a member account" and log in using your EA member account. NOTE: this may be different than your UO account name - in particular, older accounts may follow the pattern "uo_youruoaccountname."

- The next screen should give you the option to select a security question. Follow all prompts to create a security challenge question and answer. Type carefully, and choose an answer that only you would know.

- Hit "Cancel" - unless, of course, you want to actually create another UO account The security question will be applied to your account.

This security question will be used whenever someone requests a password for that account. If you forget your answer, you will have to contact Customer Support to get it reset. We strongly encourage everyone to take advantage of this feature!

Remember to always use the best security practices to not only protect your Ultima Online account, but also your email and personal computer.

good info. trust me, after you get hacked you will get zero help from Customer Support so best to avoid it if you can.