[GoblinSlayer]

If all sessions expired, then the user doesn't have access to information either - same access as the attacker. There are cached copies of emails too.