I don't think they "accessed" any data directly, rather they used the support access to initiate an account recovery (which I assume is very common, to help peo

I don't think they "accessed" any data directly, rather they used the support access to initiate an account recovery (which I assume is very common, to help people who have lost their 2FA), and from there were able to take over the account. I do agree that there should probably be higher limits around initiating password reset for some very high value accounts.