Comment by scandinavian

Sure, if they implement verification steps to ensure that the site is owned by the person attacking it. The verification steps could be similar to the ACME challenges:

https://letsencrypt.org/docs/challenge-types/