Reset Password through account recovery will take 27 days to get when your old phone is not available

My wife works for a bank. She had an iphone which was linked to her official Apple ID. She went on maternity leave. While she was on leave, her bank gave her iPhone to someone else. Once she came back to work, she was given a new iPhone and a new mobile number. But she forgot her password. When she tried to reset her password (there are two ways: (1) via I forgot website link (2) via reset password on Apple support app), she could not as all MFA code were being sent to the old phone which she no longer has. No matter what we tried, it all required the old phone. Only with the I Forgot link, we were able to list the new phone number. But the message we received on screen was that Apple will review and get back to her in 24 hours. After 24 hours wait, Apple sent an email that she will be sent a password reset link after 27 days on June 9th. WOW! When we called Apple support and got to talk to L2 support, they could not give a satisfactory answer. (1)Their view was this is all automated, 27 days is the max period. You can get the link anytime in between. (2) There is no override by anyone senior to trigger the reset link. (3) Why it will take 27 days, the person could not respond. So it is ridiculous that a system check on her identity will take 27 days to send the reset link. It is ridiculous that the L2 person could not explain what are the processes involved, what happens on day 1, day 2, day 3, all the way to Day 27. Why is it 27 days and not 25 days or 15 days. It seems that this is a serious flaw in the operational aspects of the password reset process. No one is asking the Apple support to reset the password manually. Rather trigger the event that sends the automated password reset link email/text now, instead of waiting for 27 days. It does not make sense. Are we the first person to have faced this? Or does everyone who goes through this have to face the same agonizing wait? But Why? Anyway, here we are, waiting for the next 27 days to get the password reset link. The only other alternative is to find who has that old number within the bank staff and for my wife to get that number back. This seems to be the only way to get around this stupid flaw in the password reset process. Thanks