On the other hand, changing all the addresses to false ones, is a good way to see which accounts are active and which are not. Active ones get their addresses updated and then get their payouts. Inactive accounts get ignored/ email sent to user to activate (change the address) again. Hacked accounts will not payout to hackers. The hackers, like us, have no idea what is going on.
Now that would be put a positive spin on the whole thing...
Yes, that would be a slick way to determine which accounts are still being actively maintained. If he went back to auto-payout, any account with the 'default' addresses will get skipped for future review.
However, it would be good for Chris to send emails to everyone letting them know to go back and double-check their account.