Happens with GitHub Pages too. You can crawl for repos with CNAME file and if any of those repos is removed or CNAME is removed, you can takeover.

I believe this is now hardened a bit by setting the CNAME to a GitHub domain with the user/org as subdomain.