That’s not a hypothetical. It’s the default state of most early-stage companies. Someone joins, gets added to whatever the team is using that month, and when they leave, the person doing the offboarding remembers the accounts they personally know about and misses the rest — because nobody ever wrote down the full list in the first place.

This matters more than it sounds like it should. Access doesn’t need to be exploited by a sophisticated attacker to become a problem. It just needs to still exist.