How? By finding bugs in the interface that allows hostile users to set new values for the email address at the registrar and using this for triggering the 15 days period?
Or if I didn't want to do anything actually illegal, I'd probably have an enhanced chance of success in pulling off the Domain Registry of America scam and convince people they must update their details [by transferring to my registrar] in the next 15 days.
Seems almost certain to become the most frequent uses of the contact details ICANN has kindly ensured will be up to date and accurate.