If you have an email account on your own domain, and then don't need the domain any longer, make sure that you remove from FB (or other sites), and passwords linked to that domain.
A few days ago, someone registered my old domain, created an email address I used to register to facebook and tried to get into my account. Fortunately I was online, and with the help of facebook tools, even though the hacker did get in briefly, I was able to kick him out and secure my account before any damage was done. This all happened within twenty minutes of the first email from FB offering me a reset code for my password.
My bad for not removing the email address.
TL;DR - don't leave old email addresses as alternative contacts; remove them.