Alternatively you could do a whois query of the domain (and verify against cached details) before sending out the recovery email. It's probably best to do that

Alternatively you could do a whois query of the domain (and verify against cached details) before sending out the recovery email. It's probably best to do that every time the email addresses are changed or updated.