If your friend put in a ticket to have the old Authenticator / Phone Number removed they should have received an email asking account specific questions. She would then need to open a new ticket with those answers, referencing the previous ticket ID.
The only “runaround” I can think of that might happen is if she is either replying to the original email instead of opening a ticket or have been unable to answer enough of the questions successfully.
If she can provide a ticket ID I might be able to take a look, but I would encourage starting a new thread.