At this stage, it’s only a scenario of using the self assistance password reset performance for Okta or Entra (which you'll be able to get about as you now possess the MFA issue to verify oneself) and voila, the attacker has taken Charge of the account.  example.com's servers Y