Hey,

Thanks for the bug report.

We've investigated your submission and made the decision not to track it as a security bug, as we know about that behavior you described. It will also not be accepted as part of our VRP.

We've reviewed our logs for the attempted recoveries on the account in question, and concluded that at no point was the account at any risk of being hijacked.  We often ask users for a contact email at which we can reach the claimant of a lost account before we have enough evidence to return the account.   We do this so that we can reach the user if we decide at some later date to give the account back.  We even sometimes send a verification code to the provided email account as a means of ensuring that the user did not mistype the address, which helps prevent us from handing the keys to an account to a stranger.