Not using 2FA on the admin account is the real crime.