Automatic recovery requires an already active 2fa. Accounts without it must be reset manually by an admin.