How can fully patched, 2FA-protected accounts still be breached?