A good friend's AOL email account was compromised. They'd been AOL customers (paid) for years, though when the email service went free, they discontinued payment and got broadband service from another provider.

AOL insisted that they give the credit card number that had been associated with the account. A card which hadn't been used and hadn't existed for years. Needless to say, it wasn't available.

For all I know, that email account is still active and valid, though hopefully no critical information is being sent to it.

Again: figuring out how to identify your true customer (or user) is hard.