(2/3) The hijacker(s) had already changed the account password, set up new two factor authentication and performed hashtag-hijacking.