An expensive brick?

Let me preface this by saying I'm not an iPhone user myself. I'm posting this on behalf of my son who is struggling with his iPhone XR, and Apple can't (won't?) help. A few weeks back, it would appear that his iCloud account has been compromised (strangely, not long after a messy break-up). His Apple account password has been changed, and the only recovery method is a phone number that's unknown to him. His iPhone still works, but naturally no iCloud services work, and he can't create a new AppleID without signing out of the current one. He bought the phone brand new from JB HiFi (and I'm sure we can get proof of ownership), but apple simply fobbed him off and said "contact law enforcement". I appreciate that security exists for a reason, but there must be a way we can prove ownership and have the device reset so we can use a different account. Can someone offer any advice, please?