It really is worrisome that Trump's Twitter is that vulnerable

[LonePirate]

3. Being able to lock an account is not the same as being able to access an account.

We don’t know enough about Twitter’s user administration tools to know what functions they perform apart from suspending, locking, deleting and verifying accounts.

Most websites do not allow internal staff members to hijack user accounts. I have no idea if Twitter permits that or not. If it does, I suspect a critical priority effort is now underway to prevent anybody except the actual account owner from being able to use an account (apart from account hacking). Still, expect Twitter to be feverishly to improve account security.