> should be suspended without immediate communication with the user I don't think we have enough information to definitively prove that his email address is st

> should be suspended without immediate communication with the user I don't think we have enough information to definitively prove that his email address is still accurate on the account. If the account was taken over by a malicious user (hopefully not because they claim MFA was enabled), then the new user's email address may be the one that was notified.