Myles has a good point about public email to account emails being different sometimes (https://twitter.com/MylesBorins/status/1523811989797093376 https://twitte

Myles has a good point about public email to account emails being different sometimes (https://twitter.com/MylesBorins/status/1523811989797093376 https://twitter.com/MylesBorins/status/1523811989797093376). There was a way to resolve account usernames to email addresses through a quirk of the user interface up until last year. Fortunately, they're really good with dealing with bug bounties and had it fixed less than week after I reported it. That said, domain based accounts for something like this is still a big vulnerability. Perhaps something akin to the UK OFCOM amateur radio license requirement would work, requiring people to update/confirm their details at least once every five years, or in this case, yearly?