@yura get their IP from the server logs and ddos them >:3c (if they are not using a vpn lol)
Otherwise DROP their IP and give me a new PW through cli

Second stage for fedi admins.

Somebody contacts you from known or unknown account saying that they are your server users and their account was taken over by hackers.

Your actions?

@yura ask for an identity check, like email address confirmation, TOTP secret, comparing the IPs that logged into that given account, ask if any of their friends/fedi mutuals can confirm this, ask if they have proof like a keyoxide/PGP/SSH key or a website which links to that account to crosscheck