Not sure if it’s a valid data point or not. I manage 7 people’s Apple ID accounts. This has happened a few times including twice last night but only on the people who use the @icloud.com as their primary email address. Assume that is related to password guessing attacks. Both addresses are in public email leak databases. Can only advise that you should have recovery contacts and a recovery key set up in case somethin…
Seems like a dangerous advice for a regular person who can just go to Apple and get stuff back?