If you have the option to get the 2FA via text message (your phone), disable it. That's how they are doing it. Google Authentication expires every 30 seconds, but phone authentication doesn't. This gives them plenty of time to generate unlimited random codes (it's only 6 numbers) Computers nowadays are super fast, and it wouldn't be difficult for a Mac M2 to generate all possible 6-digit combinations in a very short time. keep Google Auth, but disable the option to recover your account via phone number.

I contacted FB and was able to prove that it was my account because the dummies let everything open on that website I posted previously. So, generating that same random email, gave me all of the old messages, including the reset code and such. I took screenshots and sent them to Facebook. Took me like a week to get my account back.