There is so much manipulation of Twitter. It's really sad. Maybe someone was after his username.
How did they get past 2FA with Authenticator? Exploiting a bug is most likely? Does anyone know?
Could be his phone is hacked and rooted. Maybe he saved the key from the authenticator app to the cloud and his account there is compromised. Could be that twitter is compromised.
Personally, I'd bet on his phone being rooted. If Twitter was compromised, they'd go after much bigger fish.
Didn't the double-your-crypto scam last july also bypass 2FA?