If the attacker already has control of the email address, they can reset the account without going to such lengths--just visit the site and request a password reset.