Does this vulnerability affect people who added a phone number but then removed them? Last time I tried, this method was effective for getting around the "suspicious activity" lock.
I have a small network of legitimate accounts that they've suspended a few times. In this last round of suspensions, I can't reset any of them with my phone numbers any more.