I didn't have 2FA on... I do now....
I'm a secondary school IT Manager with 1700 school-owned iPads under my control - we prefer students not to use 2FA cos it locks US(IT Support) out of the devices!
Fortunately I PDF all my online order confirmation screens, so I could tell them the date, time, URL, order no, ....
Clive, if you don't have original invoice from authorised Apple reseller, you can forget it.
What I don't understand is... on iOS if you enter the device's own passcode it lets you in and you can start verifying etc. On a Mac, you NEED the unlock code that the hackers set - there's no two ways about it. You can't sign into iCloud and "cancel" the lost-mode or reset the passcode.