Google has been pretty strong on encouraging users to enter a "backup" email address. At least, on 4 different gmail accounts it pestered me mercilessly until I gave it one.

Seems like if you are trying to reclaim a domain then requiring the user to verify access to their "backup" email address could be a simple step that would help a lot.