I agree, as big as a title that it is, they should undoubtedly have 2FA. I had a similar event happen to me. I was able to recover my account and update my username 30 days later but I do think there should be exceptions to this rule.