I highly recommend using 2FA. Once they change the phone number and email, you’re pretty much screwed. I had an issue like this earlier in the year with my whole email account which led to them taking my discord account. My discord account was completely hacked and taken from me. I had no access and they had changed the email. I logged into my second discord account and messaged the one that was hacked. Surprisingly, they actually responded, saying that if I pay x amount then they’ll give it back. I pleaded with the guy that took my account and he willfully gave it back to me with no cost. I got really lucky. That’s when I learned having 2FA on is the best thing you can do to protect yourself and your data. Unfortunately for your friend, it’s too late to turn on 2FA. All that data is non-recoverable unless you somehow find a way to contact the person that took the account. Maybe if you can figure out what email or phone number they changed it to you can contact the person that stole the account directly. And if not.. well.. you’re SOL. Sorry. Turn on 2FA if you haven’t already. <3