From my understanding, they have until 30 days after disabling to appeal. That said, I don't know if appealing stops the clock on deletion, so I would do so ASA

From my understanding, they have until 30 days after disabling to appeal. That said, I don't know if appealing stops the clock on deletion, so I would do so ASAP. Facebook has a similar policy as well to gain access to an account (For Facebook, you have to show them a copy of your government ID). The problem is, if the attacker had access to the recovery email, they don't have to go through Facebook support. That's the point of the recovery email: to recover your account if you get locked out, access to it is taken as proof you are you. Also, it's possible your friend just forgot to mention it, but they _don't_ mention needing to reset their password after the attacker got in. If that's the case, that means the attacker got in with their password - i.e. they know the password. If they can try to login with their password and get "account disabled" (rather than "incorrect password"), and they didn't change it as part of attempting to recover their account, then they should assume that password is burned and need to change every account that uses it ASAP (and stop reusing passwords ;) )