If I had to guess, it was an internal job from a disgruntled employee with access to hijack users’ email address. Change their email address, reset password, open the email and then you can login. They might also need access to change the 2FA phone number if it was set.