But then if the password is reset, the original scammer has no access to the account! And the scammer cannot reset the password because they do not have access to the email.
This is true if changing the password s you to re-enter the password on every device (even those that were logged in at the time)
Changing a password should always invalidate all existing sessions. If you aren't doing that, then you are doing it wrong.
Edit: Or at least invalidate all sessions initiated using the old password if you have that tracked.
> Changing a password should always invalidate all existing sessions
Doesn't with Google. They display a prompt and let you select which sessions to expire.
Netflix offers SMS password resets.
Should that not be a big enough red flag in most cases (I have to reset the password on this account -> maybe it isn't my account)?