Claims can be made for any unclaimed site. I've reversed claims as an administrator, mostly for testing. I've yet to see a malicious claim but without some more administrative control they could become an administrative headache. Nobody wants that.
Each site stores information in two subdirectories, pages and status. Status holds the site's flag, favicon.png, and the claim status of the site.
With OpenId I could unclaim a site by deleting the open-id file from the status subdirectory.
Mozilla discontinued "Persona" authentication service
With Persona I've had some trouble unclaiming because Persona keeps some status information in Mozilla servers in addition to what wiki keeps in the status subdirectory. I believe my problems have come from this information being out of sync after an unclaim. I was testing, I wanted to turn around and claim again but Persona got confused.
I believe but have not shown that deleting Persona information from status will not confuse Persona's claims on behalf of another individual.
This should be tested.
Our Persona implementation was done by an engineer from Mozilla's then Persona development team. Wiki was a hard install because it is different than most websites and was also younger code at the time.