They also had a security bug in their SMS-based recovery system, according to other commenters in the thread.