But then if the password is reset, the original scammer has no access to the account! And the scammer cannot reset the password because they do not have access to the email.
Edit: Or at least invalidate all sessions initiated using the old password if you have that tracked.
Doesn't with Google. They display a prompt and let you select which sessions to expire.