Last week I received an automated email from them saying my 2-factor settings had changed and that if I didn't initiate it, please contact them.

I contacted them and they sent this: "You received an SMS and email notification indicating that your 2FA settings were changed. Please note that this message was sent in error and your 2FA settings have not been changed."

Wow.