The perp can regain access to the account by using alternative forms of account recovery in the account management settings, which the user would unlikely notic

The perp can regain access to the account by using alternative forms of account recovery in the account management settings, which the user would unlikely notice if he doesn't suspect anything amiss. e.g. an SMS password reset link sent to a phone number the perpetrator controls, or a secondary email address.