They don't need legal basis, it's their platform. You don't "own" an account. Plus, they do warn you:

"Account names may not be inactively held for future use. (...) Inactive accounts may be renamed or removed by GitHub staff at their discretion."

https://help.github.com/articles/name-squatting-policy/