I agree, but read that at least one of the users had 2FA enabled and still lost their repos. They said they received no notification emails either.