That seems the most likely scenario. This was their make or break opportunity. They should have disabled password resets as soon as twillio deplatformed them.