Or change their password and remove the mfa token. The instructions for how to do so are in my administration toolkit for account recovery - and they are just a

Or change their password and remove the mfa token. The instructions for how to do so are in my administration toolkit for account recovery - and they are just as valid for hijack.