Apple won't let a friend of mine recover a very old Apple ID because they can't remember the original password, long before 2FA was available. There are iTunes associated with the account. The Apple ID is an email address consisting of the person's first name and last name, at a domain they control (so clearly theirs), yet Apple won't provide any way at all to recover the account, even after repeated requests. Ugh!