This seems to have happened to me somehow. I was forced to sign up to unfreeze my credit report (after freezing it years ago without an account) and now it has 2FA configured with a phone number that isn't mine. I have no idea how that happened and now I'm concerned that a stranger has control over my account. Hooray!
I tried calling to reset my password, which pointed me back to the website. The only other option is to reset it by mail. Amazing.
Edit: and to top it off, the reset password page references a security question & PIN, without ever asking for those.
>If you do not know your security question or PIN, you will need to contact customer care to reset your password.
Edit 2: I just created a new account with a different email without a hitch. I got an email to the original address saying that there was a change to my account settings, leading me to believe that creating a new account simply changed the email address. Still no email confirmation though.