There is no easy way at all to solve this problem. Especially inexperienced people who buy accounts think that all you need to recover is a registered email (since this is all they need to recover their own account). Especially difficult is the timeline in question. If I sell an account and in 2013, someone asks me to recover it back for him (say, because he was phished), I'll do my damn best to try. However, I may move hundreds or thousands of miles away. It's not my fault he was an idiot and got phished, but according to your proposition I now have to replace the account? What about if it wasn't stolen from the buyer at all--he was merely faking it?