I had my facebook account taken over a couple months ago. The person used my compromised password to log in to facebook. Facebook sent me an email saying "hey this doesn't look like you, here's a '2fa' code to put in before you can log in".

Then, despite my email account not being compromised, such that the person COULD NOT have gotten that code, facebook let them in anyway, let them change my backup phone number and email accounts, take off my phone number and email accounts, change my password, and fully take over my account.

What the hell was the point of that "code" if facebook let them in anyway? As the account no longer has my email address or phone associated with it, I can't recover it through those channels. I got the the point where you can send in a selfie with your ID, sent that, and got an email (with zero "case ID" or communication channel) that said verification normally takes 2 days. It's been over two MONTHS. So I guess there's nothing I can do?