Proving a user's identity after the user has forgotten his private key and password
The easiest way to manage this sort of situation is to send people an email confirming that they signed a document.  This is akin to the standard password reset pattern of "if this was not you, please notify us immediately."

If you try to make it stronger, you run into the issue that the server is the only party here that is verifying identity.  It is the entity that is saying "this signature came from someone who can read XYZ's email address."  If the server cannot be trusted, then there is no trustable entity verifying anything.  And, given your situation, its unlikely the users themselves are adding any verification into the system.

One other tool you can use to build up trust is to use a blockchain like approach for the records.  When people sign contracts, they also sign the chain of contracts.  That would make it much harder to forge a single signature from years ago without invalidating every other signature in that time.  You could also require the users to review recent signatures, building more belief into the blockchain.

But in general, if you're not going to take the time to build in a full identification system (which involves an in-person meeting), then the strength of your system is built on its auditing, not in its initial signing algorithm.