Many years ago, before MFA was really a thing, I changed my email address to get away from the spam list I'd built up in my youth. Still, I had used the account

Many years ago, before MFA was really a thing, I changed my email address to get away from the spam list I'd built up in my youth. Still, I had used the account for some personal communications and was concerned some people wouldn't catch immediately update their address books, so I set up a forwarding rule to my new address for anything that got through the spam filters. The old account has been silent for years, to the point that if I'd forgotten whether I'd even deleted it or not. So imagine my surprise when in the span of a minute, I get several forwarded emails from Google stating that the account was recovered, a new device has signed in, password was changed, secret question changed, and recovery email changed. Now, as far as I'm concerned, the account is dead and hasn't been linked to anything I've signed into for years. But that doesn't mean it was never linked to anything important and who knows what's still sitting in the archive or who's still in the contact list. So as soon as I saw the messages I jumped to figure out what happened. But it turns out that all these security alerts from Google are just to "let you know about important changes to your Google Account and services" and if there's a problem just tell you to click a button to login and "Check activity"...which is difficult to do when all your security information has been changed before you have time to respond. There are options to try old passwords and linked email addresses, but after several attempts all I got was "Unfortunately Google couldn't verify that <the account> belongs to you." and a link to "Recover your account"[1] that just tells you to try the recover options that have already been prompted for, and if all else fails "consider creating a replacement Google Account." There is no contact information, no option to let anyone know you have a problem. The emails alerts are sent from the uncaring "no-reply" address while Googles "Contact Us" only gives a physical mailing address and directs you to the same help articles. Now, again, the account is--has been--dead as far as I'm concerned. But considering the forwarding rule was still in place Google probably thinks differently. So now the account, and everything in it, belongs to someone else. The moral of the story is not only do you need to practice good security now, you need to have done it your whole life, and go back to do it better when new security practices are adopted--before crooks do it for you. 1: https://support.google.com/accounts/answer/7299973?hl=en https://support.google.com/accounts/answer/7299973?hl=en