Hijacked214 wrote:
It looks like that’s where we are on this. But I don’t understand why Apple can’t shut down the hijacked Apple ID.
Unfortunately, you have so little context left for the Apple ID that you are now indistinguishable from somebody else that’s trying to socially engineer their way into that Apple ID account.
The contact email addresses and phone numbers and other details, any use of iCloud Keychain and the passwords stored there, passwords in email messages, any associated payment info, and the rest of that Apple ID, are are now all in the wind, too.
Maintaining control of an Apple ID is why there is two-factor, why recovery contacts exist, why Apple has password monitoring and password security advisories, and other mechanisms all exist, too. (Why there are Legacy contacts as well, though that situation is slightly different.) Because loss of control of an Apple ID gets ugly.