Also if someone attempts to change an email address linked with an account, an email could be sent asking for confirmation. 2FA is also becoming easier to imple

Also if someone attempts to change an email address linked with an account, an email could be sent asking for confirmation. 2FA is also becoming easier to implement for low level developers with Authy and Google Authenticator offering simple to follow boilerplates and documentation. Validation algorithm that forces a dictionary attack on password before successful registration could also be prudent. Just like SQL injection and query prepare statements, issues are very much known but it's the want and need to act on them. GDPR should start to help this, but management tier individuals who push development time scales are also needing to be 'sold' the importance of this.