Hacker News Reader

Sure, but that is usually by the request of the owner, if I'm not mistaken?

Better cover most of the cases than none.

All I’m saying is if you’re building such a system you should be aware of this and possibly account for it with some low frequency scanning before listed expiry. Or not, if you decide it’s not worthwhile.

Fair enough.

Alternatively you could do a whois query of the domain (and verify against cached details) before sending out the recovery email. It's probably best to do that every time the email addresses are changed or updated.

Could also be renewed