The article pretty clearly states 2FA was enabled for the Namecheap account in question. In fact, that is sort of the whole point of the article.
https://news.ycombinator.com/item?id=11480221
You should not be able to overcome 2FA with social engineering wtf!