The mitigation recommendations in that thread seem a bit weird, effectively telling people to completely abandon compromised accounts.

Does discord have some weird architectural aspect that doesn't allow for a regular a) change password, b) enable 2FA, c) logout all existing sessions mitigation to leaked credentials?