besides the whole "we dug through slack and got your AWS keys" i think the worst case scenario would have been removing MFA from an a compromised account and having access to the e-mail to self-serve the password reset.

that and maybe going through JIRA and seeing if anything was of any interest?

Do you know if Okta support are/were able to change a user's email?

You can indeed change the email / login on a user's profile an an org admin, but we probably won't know if Okta support agents themselves can also do that.