As Afuna said, we're working on ways to work within the OpenID spec to improve the process. Account recycling is an issue just about anywhere, though -- for example, while I was working at LJ, a frequent issue was people's accounts being broken into because they had initially registered with an email address from a provider that closes accounts for inactivity and recycles the username. The only way to completely prevent it is, as you say, not allowing usernames to be reused -- but then you have the problem of namespace exhaustion.

There is no good answer that solves 100% of the problems involved, so we're doing all that we can to minimize the risks and documenting the risks that remain.