Activation lock due to account hack

My daughters iPad has been removed from her Apple account and the activation lock is requested when she turns it on. The email address hint displayed on the screen is from a Chinese domain and reading some online forums, this is a known hack that often leads to a ransom request.

I've contacted Apple tech support but they refuse to do anything without proof of purchase. The iPad is about 5 years old so I no longer have a proof or purchase. I have the device in my possession and the home screen still has a photo of her on it so I can prove it's her device. Plus the serial number will have been linked to her account previously so someone in Apple tech support will be able to see that.

I get the impression this is a major security flaw Apple must be aware of but refuse to admit, otherwise how did the hacker get around the two factor authentication? Are the tech press aware of this and have others had the same issue?

And why do they refuse to help, instead referring to policies clearly designed to get me to part with another five hundred pounds and dispose of a perfectly working device?