Shortly before I received password recovery codes to my email, from all facebook accounts I have.
My email requires 2FA, as does my facebook account, but when I went there and clicked "forgot password" there was an unknown email address added to my account. That shouldn't be possible.