The hacker changed the recovery phone number and email address ... step has already been completed gives the attacker complete control over that session—complete control to go and change ...