That doesn't work anymore. I wanted to get access to some old emails after I let my account lapse. Recreated the same account with same password: completely empty.
But the security hole is not that you can access someone else’s email messages.. it’s that you can do ‘I forgot my password’ flow for accounts associated with an email address that was previously owned by someone else!
This is the only reason I chose not to delete some old accounts from different sites, and check on them yearly-ish. I used to think the internet as ephemeral, but I don't have that luxury as long as anyone else doesn't. From relatives to banks the authentication crisis is real. My soul is forever bound to some shitty teenage usernames and some poorly secured hashes distributed around the world.
Not for the email provider. If the only authoritative identity for an account is “can receive an email at a given address” you’re just admitting that you’re outsourcing your security to an implementation detail of a few large email providers that you have no control over and a bunch of small email providers that you have no guarantee behave the same way.
