Consider a domain that had been in active use for some time but is no longer desired — perhaps the company is out of business or a name change took place years ago, or whatever. The domain registration will be allowed to lapse.
I'm guessing there are potential vectors of attack by "dumpster diving" a second-hand expired domain.
One thing I can think of are user accounts registered using email addresses from the expired domain. I imagine that the new owner of the expired domain could submit email addresses to "forgot password" forms on any site and gain the logins of dormant accounts.
Some critical logins such as banking, hosting or DNS accounts even ask for a secondary email address to help users in case they lose access to their primary email address. In fact, it's often these secondary addresses that get forgotten that they were once registered somewhere. This could leave them exploitable should that dormant secondary email end up in someone else's hands one day.
Are there other known exploits to be concerned about with expired domains?
When planning to vacate a domain, what steps can be done to protect the original users of the domain?