> many sites persist access logs and can answer “Which IPs accessed this account?” for a very long time indeed.

What would a very long time actually? I don't have any sysadmin experience, so I'm not sure. One year? Five years? I guess at some point there will be just too much data to keep everyone's logs...