A potential easier approach could be detecting when an existing auth0 user attempts to access an abnormal auth0 subdomain. Even if the user gives up their user/

A potential easier approach could be detecting when an existing auth0 user attempts to access an abnormal auth0 subdomain. Even if the user gives up their user/pass accidentally you could send an email warning to review their activity. You can fingerprint the user's browser or ip address to help identify them if you don't have any other info.