Qbo account compromised even with mfa

I was contacted by a new client that has a qbo account hacked into even with mfa with text verification on . The employee has verified r getting four back to back text cord but he did not act on it as he says . I had them contact qbo and I was on the line when they called qbo support . The qbo support did nothing and had no guidance. This is shameful Quickbooks if you are reading this .
I am not sure how they could have got in ? This a new client and I don’t know the compromised employee but he sounded like he was giving me accurate information. My assumption is that he provided the mfa text to someone by mistake but h tells me that he was sleep when the text mfa codes came in. . Has anyone had this with qbo ? I can’t imagine an mfa token theft because we have confirmed the back to back mfa text that he got on his phone .