The victim has an excellent point: Why didn’t Vultr simply send an email to at least notify the account is being reported as compromised.
Same solution could be used to avoid SIM swaps. Send email/text notifying owner that another party claims to be locked out of account. Give 48 hours to respond.