Some services use this pattern: When you login, every now and then you are asked to confirm things like email address, mobile phone number, physical address etc. There could be a syspref to say how often the confirmation should be required, and another to list the fields that need confirmation. This could build on bug 21190 to track the number of logins. (Just an idea, not planning to work on this in the foreseeable future.)