Does Twitter even permit that? If I recall correctly, it forces SMS 2FA. In this case, Jack's account would've been compromised regardless because the tweets

Does Twitter even permit that? If I recall correctly, it forces SMS 2FA. In this case, Jack's account would've been compromised regardless because the tweets were sent via a third-party application that he had authorized to use his account.