Sorry. Should have been clearer. There’s a screenshot showing a password reset about to happen for a specific person. We suspended that account. In parallel, we were using our own logging to look for any password reset/MFA change over the last four months and just went ahead and forced a reset for all those users.
As far as I can see, there's a lot of cloudflare accounts visible in the screenshots shared by the group. Stuff like cloudflaretv1, etc..