Former sponsor didn't have the password, phone number, 2FA credentials (TOTP app + security key, no SMS) or access to the email account.
What they did have is control of a domain used for the *previous* email account months earlier, but not the email used to create the account.