Once a msisdn is associated with an account it's there for life, but the msisdn might be recycled.

[lampholder]

This came up because somebody lost access to their old account and wasn't able to associated their msisdn with their new account because it was still stuck, permanently, to their old account.

But more generally, unlike email, msisdns do get recycled. Basically, anybody who can perform a successful verification cycle with a msisdn should be able to associate it with their account. If msisdn<-->mxid is 1:1 (this is not a given, and I don't want to spend too much time considering it now) this should trigger the msisdn's being disassociated with every other mxid.