Comment by delive

This is where I'm confused as well and yours is the first comment mentioning it.

A more plausible scenario is that IT reset their AD/IDP password because of the lost device and gave them the temp pw over slack + some MFA token.