[cname]

The article pretty clearly states 2FA was enabled for the Namecheap account in question. In fact, that is sort of the whole point of the article.

[levemi]

Oh this comment by CIO led me to think 2FA wasn't...

https://news.ycombinator.com/item?id=11480221

You should not be able to overcome 2FA with social engineering wtf!