It has been possible in some instances for an attacker to port a number directly from the underlying carrier, in this case, bandwidth.com.
When I saw this happen, Google was not aware the number was gone, so calls and texts from other Google Voice users still worked.
