Have they always had such a 14-day policy? If not, it’s entirely possible that the policy was different when the account was previously deleted, and the account was being retained under that old policy.

I’m also surprised that his hacker didn’t bother changing his password - maybe it wasn’t intended to be an account takeover.