No, because the attacker needs to enter the recovery code sent by email.

My assumption is that they're just guessing over millions of accounts and are expect 1-2 to hit so they can take over those accounts.