cPanel prior to 82.0.15 allows API token credentials to persist after an account has been renamed or terminated (SEC-517).
cpanel cpanel