Originally Posted by
vistaril
Not helpful when hackers temporarily change the account owner’s email to their own to receive the confirmation, then switch it back - which was something many hacked accounts have experienced.
..
then that's the part that requires 2FA - if account settings change send SMS or email to original contact info to enable that change.