So, I have a hard-to-guess password and 2FA, and the creator of Ethereum does not ?
How's your account recovery security? Is it 1FA?
Twitter's authentication was always really good in my experience, and so I doubt they are vulnerable to the more obvious types of SSPR abuse that I find on every other cut-rate website.
At least it was a tweet related to Ethereum. Probably why it lasted as long as it did.
Don't discount the possibility of an inside job by someone at X.