> someone else reported the same thing happened to them on Reddit recently, using the same RMA for a similar phone at the same Texas facility.
Taking the story as true, it'd seem to be case 1.
Taking the story as not true (case 3.), she's in a professional position where publicity wouldn't hurt.
Her report looks questonable (not necessarily false):
> They deleted Google security notifications in my backup email accounts.
If the accounts were backup, and she's a security-conscious person as she claims in the same post, how did they do that? They were backup, so they couldn't use the main account to reset them. I can think of the accounts being opened in different browsers, but it doesn't seem a very plausible scenario.