Soldato
The Dev in question supposedly received a call from 'IT' asking if he's received a Slack 2FA notification. They said yes and granted the change on the instruction of 'IT'. If that person isn't sacked by Tuesday evening I'd be very surprised.
Yeah, sadly in these cases it's almost always user error these days.