I'm making a wild-ass-guess here, but it sounds like when you clicked "forgot password" it would text you a code to punch in to verify your identity. It sounds like that part failed open. So once twillio went away, any code would succeed.