You'd would need to have the data (or the proof of absence of data) to act with confidence.
Without actual activity logs, you could do some very loose information gathering by checking (using the API) the cookies associated with your leads. If the timestamp in the cookie name is within the past 2 years, then you for sure know they have visited within the past 2 years. However, that only lets you perhaps prioritize those leads. It doesn't let you delete other leads, because someone with an even older cookie may have visited your site > 90 days but < 2 years.
As you say, it's a bit too loose for the context.
While I dug a little deeper, I've found an old reply from Mark Townsend, in an unrelated thread mentioning something about taking members of lead scoring campaigns as they gather this kind of humans. Basically, those campaigns apply score to any opened email and visited webpages. I'm lucky enough that those campaigns are active for the past 12 months in our instance. I'm going to use this data and apply a more custom "going forward process".
Thanks for your reply