The mitigation against this was probably the restriction on password resets which support lifted. They just forgot to train support how to deal with it.
(There was no 2FA enabled)
(I think the "email address doesn't work, so disabled sending to it" theory sounds more plausible actually :-))