What's this about?
Fraser spells out the security consequence: once third-level names are terminated, the second-level names (`fraser.name`) presumably become registrable. Whoever buys it can recreate `neil@fraser.name` — and inherit password resets for every account tied to that address over 25 years.
What exactly is the attack?
Email-based account recovery assumes the address's owner never changes. Domain expiry breaks that assumption; forced termination breaks it at scale, on a schedule, with a public list of which surnames are worth sniping.
Why is this worth noting?
It upgrades the story from consumer harm to systemic vulnerability: registry policy decisions can mint account-takeover opportunities in bulk. The mitigation — migrating decades of logins off a doomed address — is exactly the burden 22,000 people just inherited.