This happens all the time via credential stuffing - or even after credential stuffing someone's email inbox and searching through all relevant account activatio

This happens all the time via credential stuffing - or even after credential stuffing someone's email inbox and searching through all relevant account activation emails. Just saying "lower the security if it's been x years" isn't adequate and could cause serious harm if the abandoned account has important or secret information on it. Better to keep it secure and inaccessible if there is any doubt that the human is an attacker.