When privacy expires: how I got access to tons of sensitive citizen data after buying cheap domains

Damnnn. What I don't understand is why the old accounts still exist, they should've changed the accounts to use the new email address. Also, they should've thought to buy up the old domain and redirect it to the new domain so nobody can use that for malicious purposes.