Does coinbase really allow account recovery with just an SMS? It seems to me like the attacker must have had more than just control over your SMS number.