There is also a darkweb market in valid authentication tokens for netflix, which they seem to be doing nothing about, which seems to allow a "valid" login from any old device on the planet without needing the email address or password Fortunately they can't change the exiating password without re-authenticating but I read that the perps sometimes add a credit card to the account (with no intention of billing it) so they can then validate ownership of their hijacked account with netflix in order to do a password & email change. So always look out for unrecognised cards on the account when this happens.
I haven't seen anything definitive that explains how these get lifted but browser vulnerabilities and cross-site scripting attacks have been suggested.
