Some apps reset your password automatically (send you a password reset email) if they detect it has been leaked.
But email services appear to have a harder problem due to the catch 22 where you can't log in to reach the password reset email if they were to reset your password.
Ignoring the backup email case as the other commentor left. In practice accounts are not immediately compromised so there is enough time to send a reset to the original user.
You could also do things like having the reset require the user to have a token that was issued before the compromise to prove you were able to authenticate before the leak happened.
Comments
Some apps reset your password automatically (send you a password reset email) if they detect it has been leaked.
But email services appear to have a harder problem due to the catch 22 where you can't log in to reach the password reset email if they were to reset your password.
What do they do?
Maybe recovery email. Gmail once in a while asks me to set one up.
Ignoring the backup email case as the other commentor left. In practice accounts are not immediately compromised so there is enough time to send a reset to the original user.
You could also do things like having the reset require the user to have a token that was issued before the compromise to prove you were able to authenticate before the leak happened.