Force them to change their password, prevent use of the account? If it’s a dormant account, force a password reset using email?

Doesn’t feel like an unsolvable problem, certainly not one without edge cases but surely we can hit 80/20 without too big a hassle.