[op00to]

1. Disable the account from further access.

2. Send a postcard to the billing address where you signed up (verified against credit reports) with a one time verification code, upon which some second factor is set up. Maybe put 20 "rescue codes" on the postcard too, if you like.

3. Force user to enable some sort of second factor authentication on their next login.

[vel0city]

Imagine a service you paid for locking your account and sent a postcard to an address you haven't lived at in a decade. What a great user experience!

[op00to]

if you paid for a service, the onus is on you to keep your information updated with that service.

[vel0city]

Do you actually update all your address in every service the moment you move?

[op00to]

Ones I care about, yes.