Reading the page edit history it looks like the “stolen” claim is coming from a now deleted reddit post, hence the no citation.

Annual/routine email verification fills that need, though. For the sites i do support desk for, an email verification link is sent during account creation and then annually. If the email address is not verified then on login the account holder is prompted to either resend the verification link or change it and verify the new email.