I was going through my account settings today and noticed that two factor was disabled. I thought this odd as I usually set it up on any account I use, so I of course turned it on and went about linking my authenticator app and generating account recovery codes. Yet in my authenticator app there was already a Mozilla account with my email, but the codes it supplied did not work. I also found old account recovery codes I had written down which did not work either.

What could have happened to cause this? I must have had two factor on sometime in the past and added it to my app and generated recovery codes. How could it have been disabled, the old codes made invalid, and Microsoft authenticator unlinked? Am I looking at an account breach somehow? I have no unusual activity as far as I can tell and no recent data or password breaches. The only thing I can think of was I removed a number of old devices from my account and signed out of them, but I still own the old PC's so no one could be using them.