You know that there are many appeal-threads where users already provided their signed message. The hacker will simply create a new email and copy paste the signed message.
That's why signed messages for account recoveries have to include the desired new email and a date.