Apple ID stolen AND revised

My friend’s Apple ID was accesses somehow. He uses 2 factor authentication and a password manager, so he has different 20 or more character passwords across ALL profiles. Still, the hackers somehow accesses the Apple ID, deleted the phone number, added a new unknown phone number, removed all devices associated with the Apple ID, and changed the name. All of this was done within 10 minutes or less before my friend saw the emails from Apple and could stop it. My friend still has access to the email address associated with the Apple ID, but somehow that is not enough to log in because Apple now also asks for the phone number to confirm the identity. And as I said, the phone number has been changed and is unknown. How do we log in with the email address if the devices have been removed and the phone number changed by the hackers?