No, because the attacker needs to enter the recovery code sent by email. My assumption is that they're just guessing over millions of accounts and are expect 1

No, because the attacker needs to enter the recovery code sent by email. My assumption is that they're just guessing over millions of accounts and are expect 1-2 to hit so they can take over those accounts.