Real recovery will require a verified channel and will never move membership between tenants.
Authentication and delivery to real users remain closed.