I have my money on social recovery/rotation for what it's worth.

If a few close friends report the account as compromised, for example, and say "this is their new npub" - clients could easily pick up on it.