Your old drone is / was bound to the controller under your accounts email address. Anyone finding the drone will have to bind and register the drone to a controller under their own DJI accounts email address. So they will already need to be a DJI owner. Binding cannot take place without a DJI account. DJI are very strict on changing aircraft bind email addresses to the point where it is a detailed task even to change your own binding email address to a new email address, as they send a binding change verification code back to the old, or original owners, email address, not the new owners. (sorry for the many uses of the word binding)
I am not an expert but my understanding is that the old drone wont bind / register because its serial number was listed against your accounts email address and (maybe) has been recorded as being lost. DJI may / should have deactivated its binding ability, and therefore it wont fly, particularly if your drone was replaced under warranty.
Many people don't realise that, if you change email addresses, you really should go through the process of binding the drone to your new email address as it can cause confusion later on when claiming care refresh, informing of lost drones, warranty claims etc.
However, in the wonderful world of hackers, who knows.
