She believes she had 2 factor because she used the app on her phone and would enter in codes. But her phone was remotely wiped (presumably by the attacker) and lost access to the authenticator. She can't verify that way anymore because the attacker took that tool away from her.

She is still logged into her account on the laptop, so she can see things, but can't make any changes (they require a password she no longer has since the attacker changed it). We saw what the attacker changed the recovery info to their email / phone as well. So recovery options aren't working. She is trying to pass their email/phone along to some form of law enforcement.