Correct, but it's probably not necessary to permanently lock someone out. All that is needed is a significant delay. You could just block access and say "come

Correct, but it's probably not necessary to permanently lock someone out. All that is needed is a significant delay. You could just block access and say "come back in 28 days". In the meantime, warning SMS and email messages could be sent to the account contact alerting them of a possible takeover attempt with a link to disavow the attempt.