I have only reimbursed 3 of the 16 accounts that lost funds so far.  I have blocked access to the others, and am waiting for their owners to contact me and demonstrate that they have secured their accounts before refunding them.

I expect most of them were old forgotten accounts with what their owners considered 'dust' in them.

JD uses URLs as a login until you set up and username and password.  Once you've done that, the URL no longer works.