I think they're saying the initial compromised user didn't have MFA, not that the attacker's new account didn't. But indeed, I almost thought this attacker was

I think they're saying the initial compromised user didn't have MFA, not that the attacker's new account didn't. But indeed, I almost thought this attacker was pretty competent (given the wait until the holiday) until I saw they made a completely new account and left it there for half a year.