The article states that if 2FA is enabled, then answering a security question or access to the recovery email is also required.