Amazon should simply treat users with active 2FA accounts as high security accounts. High security accounts must go through a much more rigorous validation when speaking with support.