If I understood this correctly, two factor authentication was irrelevant. Whoever did this just forged the cookies and had full webmail access regardless of an

If I understood this correctly, two factor authentication was irrelevant. Whoever did this just forged the cookies and had full webmail access regardless of any authentication method.