My wife's Amazon account was hacked yesterday. She discovered the purchases, changed her password to both gmail and Amazon, and enabled Amazon's 2-step verification (2FA) through SMS on her phone and figured the matter was done. However 3 times now the malicious actor has disabled Amazon's 2SV without her receiving a single text from when they are logging in. Amazon also seems to require providing a OTP when attempting to change any security settings, including disabling 2SV. The last of these occurred overnight while her laptop was shut and presumably asleep. Amazon does send e-mails stating that 2SV has been disabled, but that is her only warning that fraudulent purchases are about to start again.
She's completely on the Apple ecosystem with only a MBP and an iPhone 11 which are behind a Unifi firewall with no ingress allowed to those machines. I don't see any malicious processes running on her MBP, and she has not installed anything recently that did not come from the App Store, and her phone is definitely not jailbroken. I can't completely rule out something running on either her physical devices, but it seems unlikely.
How is someone able to disable Amazon's 2FA without the specified 2FA device receiving ANY notification? I feel like I've ruled out everything except someone with physical access to Amazon's systems which seems crazy. Is there something I'm missing? Something else I should try?
Edit: On recommendation of another website we disabled SMS 2FA and switched it to voice. Less than an hour later it was disabled again. I'm completely stumped.
Edit 2: We finally had Amazon fully disable my wife's account. She received an e-mail stating that to re-enable the account, she would need to call a number and speak to a live representative. Sometime during the night the hacker got her account re-enabled (unsure if they actually talked to someone) and resumed making fraudulent purchases. They still have not bothered to change her e-mail address (which is odd!) but when re-enabling the account they changed the password so we're truly locked out at the moment.
Because we never logged in, it rules out a leaked session token, but it's still possible that her MacBook was being remotely controlled in the middle of the night. I was not logging any network traffic thinking it wasn't needed while the account was disabled.