Once they expire, the name is available for someone else to fill it with new content, not to get access to your existing content.

While they may not directly get access to content after a domain has been recycled… nothing would really stop someone from registering your domain, and setting up your same email address again. Which would then give them access to basically all of your old accounts just by clicking on forgot password links.

Now is that likely to happen to a random person? Not likely, but there’s not really anything to prevent it. Most services don’t prune old unused accounts very often, or ever really.