Facebook’s system for managing stolen email addresses has been broken for over a year. Posted on June 16, 2016 by jgordon Link. I can confirm all of the comments here.