Yes, but you also said it's a CYA, when indeed it's not sufficient CYA if only a former account owner, but not "this account owner," had been verified.
It's definitely CYA. Because not transferring accounts is almost definitely in the TOS. So "we didn't know it was someone else using the account, thats against our TOS" will be the response.