Hacker News Reader

What do you suggest as an alternative to password reset based on the account email?

If you retired the email because the domain expired, maybe don't let it reset existing accounts. It's dead.