[codingkev]

What do you suggest as an alternative to password reset based on the account email?

[tedunangst]

If you retired the email because the domain expired, maybe don't let it reset existing accounts. It's dead.