An attacker has obtained the password for Sams personal email account and gained access. This password does not apply to Sams work email, but the security of that account is still at risk; which of the following is a feasible follow$-$up action that the attacker might take?