Technically, Tumblr never deletes old accounts. However, if you don’t log in for a year or more, it does mark them as dormant. This essentially archives all of your posts, making them inaccessible, and allows others to use your URL. In other words, anyone could grab your blog’s previous address and post whatever they like, pretending to be you.
To protect against this kind of impersonation and reduce the chance of an attacker compromising an old account, we’d recommend manually deleting your Tumblr profile instead of just waiting for it to go dormant.