Hacker News Reader

>Bob didn’t have multi-factor authentication enabled

even if enabled, if it was set to send the code as sms it would go to ... the phone :-\

If you read all the way through, the article states this. Recommendation is "use something like Google Authenticator, etc..."