Comment by matthewdrussell

Correct.

I'm surprised no one else has mentioned no 2FA for the email. The email being compromised opened the door to this happening.