This could be anything on the scale of vibesecurity issues to serious problems in the GitHub account recovery process, because (like most recovery processes) it is circumventable if you're dedicated.

Or they just fell for social engineering.

That doesn’t look pretty