credential recovery and account takeover is trivial, most people have automated that process. once the lock is popped, all value can be extracted, verified, and pivoted in moments.