We've been going through facebook recovery, it requires pictures of ID. Same way you do any KYC. They still have access to the phone that was connected originally as well but the attacker put in a swedish or belgium number (it says 046 but google shows belgium flag).