They're lying about that being an exploit to cover their own incompetence. Ayogom barely has any idea what he's doing. Recovery process is intitiated by the recovery account, but must be completed by the real account holder by using a key that was valid in the past 30 days

The recovery account cannot do anything to your account unless they have your keys