At this point, it’s basically a situation of using the self service password reset features for Okta or Entra (which you'll be able to get around since you now provide the MFA element to confirm you) and voila, the attacker has taken control of the account. This implies you might want to be strategic and persistent with your Website positioning