I think you should just change the email on the account. I always get very nervous when taking over someone's email account, because if it is active it is often attached to their important bank info, paypal, etc. I think that's when you start treading into illegal territory..