Comment by emeidi

I stopped reading here: "While Bob didn’t have multi-factor authentication enabled"