Someone created a bogus account using my email trying to claim DNS administrative rights for all domains associated with that email (yeah, yeah, yeah - I should have had domain privacy for everything ... but some didn't)

Cloudflare ended up getting listed as authoritative DNS in its own DNS resolver (even though the registrar's records were supposed to be authoritative)

The only reason they couldn't fully steal DNS settings was I had 2FA enabled with my registrars and on my email account

Took nearly 3 days to claim the malicious Cloudflare account via password resets to my actual email address and enable 2FA on it to my authentication tools

Took another week+ to delete all attempted DNS registries and get Cloudflare to not recognize themselves as authoritative DNS resolution for the domains

And over a month for tech "support" and "legal" to finally get around to responding to my complaints basically saying, "you should have created an account with us with that email so no one else could try to steal it"