I'm wondering if it's XCheck that locked-out my later account when it decided by zombie account (I don't have the email address anymore) was a "duplicate". The check condition it fired on was visiting the 2FA settings page. Some nice wf on-call fixed it from an oops task and I don't touch that page anymore. :)