Ask HN: Facebook's account recovery broken for anyone? Can't use trusted contact

A friend of mine had his Facebook account hacked, email address and 2FA changed by the hacker and they have taken over a page that was his local business.

After trying the "trusted contacts" recovery system, Facebook approves his request after verifying codes from two contacts, and asks him for a new email address and supposedly sends a confirmation email to said new email address. The confirmation email never arrives though, despite trying multiple different email addresses.

Does anyone know of an alternate way to get his account back? Despite Facebook's recovery systems looking fairly good on paper, they seem to have let him down here. He was really dependant on his business Facebook page so any help would be very much appreciated.

Would also be interested to hear if anyone else has had a similar experience.

Thank-you.