She believes she had 2 factor because she used the app on her phone and would enter in codes. But her phone was remotely wiped (presumably by the attacker) and lost access to the authenticator. She can't verify that way anymore because the attacker took that tool away from her.

She is still logged into her account on the laptop, so she can see things, but can't make any changes (they require a password she no longer has since the attacker changed it). We saw what the attacker changed the recovery info to their email / phone as well. So recovery options aren't working. She is trying to pass their email/phone along to some form of law enforcement.

>> She is still logged into her account on the laptop, so she can see things, but can't make any changes

This doesn't make sense; the attacker changed all of her account information but didn't click "log out of all other locations"?

Bad actors make mistakes, too.

Sorry, I was in a panic , I have updated my situation in the comments , thank you