Start by sending an email (without any sensitive info) to the old account and see what happens. Compare the IP address from when the account was created / last

Start by sending an email (without any sensitive info) to the old account and see what happens. Compare the IP address from when the account was created / last accessed with the one for the password reset request. IP addresses are easy to spoof though so even if the IP addresses match you should be very cautious. If you have the user's physical address, you could send a letter with an authentication code.