You all forget something more important.
It doesnt matter what you do, it wil never be safe.
If this person goes to support and tells them somebody hacked it, and he give's out his payment info, his first email registered on.....
passpord etc etc

You know what i mean..
He can just claim the account back
But its not in all country's like this, you have to go to the police before you get it back in my country.