we don't know if the email/private keys are in the owner's hands or not as the hacking extent seems to be pretty serious.
If the staked address would be funded with a substantial amount of Bitcoin (say at least worth $500, so it's for sure more than the account is worth) for a week, would that make it plausible only one person has access to the address? If a hacker is trying the regain access by funding the address, chances are the real owner would notice a deposit and take the money.
Drawback of this method: If the real owner doesn't know the hacker knows his private key, he's screwed!