The actor name is usually the least useful part.

MFA reset → weird login → new OAuth grant → SaaS export → extortion later.

That chain matters more than whatever brand is on the email this week.