I mean, i think you answered the question yourself. History of account security details, things like login logs, IP addresses, when things were changed, payment information, etc can corroborate the story a user is trying to tell (ie, my account got stolen), or refute it.
And those things? It comes down to having strong process rules and having intelligent life forms make the decision.
And those things? It comes down to having strong process rules and having intelligent life forms make the decision.