Gaining access is different from having access though. The mechanism you're describing would require that the bad actor reset the user's password, which would a

Gaining access is different from having access though. The mechanism you're describing would require that the bad actor reset the user's password, which would at least set off some alarm bells. That's very different from being able to eavesdrop invisibly.