I run a reasonably sized web application and from time to time I get users who for various reasons lose access to the email address they originally registered with.
The user will typically make a request from their new email address asking us to update their account email to reflect the new address. In past cases this is often due to the user allowing a domain to expire.
We never sanction such requests but it does leave us in a slight dilemma, how can we verify the identity of the individual requesting the change? We don't request users to supply a postal address and the telephone number is optional.
Is this something others have encountered? How would you recommend dealing with such requests?
Any advice would be greatly appreciated.