Their notices required you to re-verify your original email address, which so far has never been required. So lots of people (myself included) had their passwords and could play fine, never mind the 10-year-old @aol.com account tied to it, and could do nothing but watch that deadline approach before being locked out.