>Is it legal to assume that the controller of an email address is the same as the person who created the account using the email address? Isn’t that the genera

>Is it legal to assume that the controller of an email address is the same as the person who created the account using the email address? Isn’t that the general practice? Maybe with extra steps, but most services allow the “I just forgot my password -> I get a recovery email” flow, which trusts that the email from which the account was created is proof of identity. Then you get access to everything else with the password.