What happens is that in these things many scenarios can occur, the first is that they can be hacked accounts and the person who was hacked has no reason to report it and leaves it like that, the other is that they sell their account to another person, and Obviously you do your misdeeds with all your apparent KYC, but this can be avoided in the case of a very large withdrawal, you can do as some protocols do in Binance, a quick KYC, that is, it can be a photo or a small video of verification that the person in front is actually the owner of that account, I think that is how they can protect an account, and unfortunately it is through KYC.