I can tell you that unfortunately that's not an isolated case. We recover stolen domain names, and it happens quite often (that someone gets into a GoDaddy account and is able to remove 2FA).