Compromised account

Other than not getting an account dump... I don’t see anything here that’s unexpected, particularly if your account was phished and breached, and particularly if two-factor wasn’t enabled originally. You have to log into the Apple, which means you will need a verification code once two-factor authentication is enabled, and if you’ve been breached then the password change—all passwords, if icloud Keychain is in use—will need updates—is to be expected.

The appleid webpage shows the security-related info including two-factor status and the trusted telephone numbers as listed in the support article.

If the iforgot requires you to change your password and verify your login before allowing further access, that’s what you’re going to have to do.

Here’s the account security team contact info: Contact Apple for help with Apple ID account security - Apple Support

And I’d tend to wonder if the account dump is simply disabled until you are fully back in control of your Apple ID—that info would be useful to someone seeking to wrest control, too.

Apologies on my previous reply too. Sorting through venting—to use your word—can be confusing to me”sometimes.

You probably got phished for your password on that first message—Apple doesn’t send those—and yes, getting phished is no fun and ends badly. If you clicked on a link in that mail message and logged in, that probably wasn’t the Apple website prompting for your credentials. As for your Apple ID, now you know why enabling two-factor has long been recommended; it gives one more last chance to maintain control of the Apple ID,

Here is part of working to repair this: If you think your Apple ID has been compromised - Apple Support

And for completeness, we’re other users like you, not folks that work for Apple.