>> How is Twitter supposed to know that the Tweet was made by the OP or was a compromised Tweet?
> For starters: it would be interesting to see what IP address the tweet was made from, whether or not it was preceded by a password change or contact with Twitter support to turn the account over to someone else.
>> When something is egregious what should Twitter do if it doesn't have resources to investigate whether the tweet was "intentional" or not, if action must happen quickly to avoid problems?
> Good question. That makes me wonder if they are able to operate safely at scale at all.
i'll hazard a guess that this isn't a factor at all, since the vast majority of cases where such differences exist could be explained by the user traveling and logging in from a different location. your abuse team would declare open riot if they needed to investigate whether every "posted abusive tweet, but from a coffee shop wifi instead of their home" needed to be evaluated as a possible hijack.
like most large services, Twitter has self-service hijack protections: you should receive email notifications when Twitter sees a login from an unknown location (i sure do) with the usual CTA about changing your password and such if you do not recognize it. that does appear to be what you should do here, insofar as they state you can cancel the appeal, delete the tweet, and regain access. asking users to delete tweets made by a compromised account sounds normal enough, given that it's both what will happen anyway
i'll grant that Twitter's account blocks and support system can be _bad_, in that they often have conflicting or outdated instructions, but that's only a problem when the recovery process fails, not when you don't attempt it. this seems more a complaint that they don't offer concierge service but, eh, not much surprise there.