So, I have a hard-to-guess password and 2FA, and the creator of Ethereum does not ?

How's your account recovery security? Is it 1FA?

Twitter's authentication was always really good in my experience, and so I doubt they are vulnerable to the more obvious types of SSPR abuse that I find on every other cut-rate website.

At least it was a tweet related to Ethereum. Probably why it lasted as long as it did.

Don't discount the possibility of an inside job by someone at X.