The problem is the rapid succession of changes to recovery phone number, country, cellular provider. There is no way to differentiate, at scale, between an account takeover currently in progress that needs to be stopped immediately to minimize damage, and a legit user deciding to change all his personal info at once.
30 day cool down period is a reasonable response, at scale.
30 day cool down period is a reasonable response, at scale.