This also means e.g. ensuring that their recovery email address and phone number are separate, as Google has in the past linked accounts via them and shut down all linked accounts.