I was typing exactly this when I saw your comment. This could very well be a real issue, but could also be a nefarious attack or even just incompetence. I've done support before and there are always users convinced that they are "hacked" or that we are doing something shady because they forgot their friend logged in on their device or forgot that they actually made two accounts in the past.