I think it can be reversed. The user could claim their account was hacked.