> Both sides are reasonable, a common form of spam uses hacked accounts that have grown organically, the normal way, and have then been abandoned.
That does not seem to be the case here.
When it comes to money, sure, take caution. When it comes to a dozen-or-so followers+followees, abandoned a decade ago with hardly any posts... congratulations, your marketing efforts or network effects were successful and they're back. Now stop trying to steal their personal data under the guise of "security".
If you must, feel free to make a password recovery via their emergency mail or something, but don't try to steal personal data.
The rest just doesn’t work; the accounts get hacked using the recovery mechanism because the email accounts get hacked or expire and they get used for spam.
It’s also reasonable not to want to provide Instagram not to have too much information because after all it is Meta, however it’s debatable whether sharing a photo with a photo sharing service is too much information.