my 2cents, the sms was set by and disabled by the oo. the sms was still on file even though he disabled it, which is why it didnt show that the 2step was added and will only show (unless you enable it, which is usually only when people try to add another number, which neither hellfyre or growing attempted to do), when the pass was changed for joe by growing, i believe dbg's system flagged the account and wants the sms to verify the change. A similar experience happened to me with an account i had an sms set and disabled on. dbg required me to enter a code they texted me for the buyer to recover the account even after he had already changed the password twice.