When a GitHub account is compromised and an unauthorized email (like the gmx.com address you noticed) is attached after 2FA recovery codes are viewed, GitHub’s Trust & Safety system places the account into an administrative suspension/lock to prevent the attacker from deleting repositories, transferring organizations, or pushing malicious code.

Because GitHub Support cannot verify identity through national IDs or passports (GitHub does not store government identity documents for privacy reasons), they verify legitimate ownership through technical and cryptographic account proofs.

Here is the exact verification evidence you should prepare and the recovery procedure to follow:

1. The Evidence GitHub Support Uses to Verify Ownership

When the Account Security team responds to your ticket, they will ask you to prove ownership using one or more of the following:

A. SSH Key Challenge (The Strongest Proof)

If you had an SSH key attached to Emcas152 before the compromise:

• Support will generate a unique cryptographic nonce/string and ask you to sign it using your private key.
• You will run:

  echo -n "<challenge-string-from-support>" | ssh-keygen -Y sign -n "file" -f ~/.ssh/id_ed25519

  (or your id_rsa) and reply with the generated .sig output. This proves mathematically that you hold the private key matching the public key on the account.

B. Original Primary Email Access

• Support will confirm whether you still have active access to the original email address associated with Emcas152 prior to the attacker adding the gmx.com address.
• They will send an authorization link to that original email to confirm it was not permanently deleted.

C. Billing and Payment Records (If Applicable)

• If Emcas152 ever subscribed to GitHub Pro, Copilot, or GitHub Sponsors:
  • Last 4 digits of the credit/debit card on file.
  • Card expiration date and billing address / postal code.
  • Transaction IDs from past GitHub invoice emails.

D. Git Commit Author History & GPG Signatures

• The commit email and PGP/GPG signing key fingerprint used in recent commits across your repositories.

2. How to Route Your Ticket to Account Recovery

If your initial ticket was submitted through a generic inquiry form, it may be delayed in the general queue.

1. Ensure your request is specifically routed via:
   https://support.github.com/contact/account-recovery
2. Select: "My account has been compromised".
3. In your ticket message, explicitly provide:
   • Target Username: Emcas152
   • Original Primary Email: (the email you used to register before the incident)
   • Unauthorized Email Added: michael.miller45881@gmx.com
   • Exact Security Alert Timestamp: October 04, 2026, 19:26 UTC (as shown in your screenshot)
   • Statement: "I have local access to the SSH key and original email previously configured on this account and am prepared to complete cryptographic SSH challenge verification."

3. Important Tips While Waiting for Support

• Do NOT open multiple duplicate tickets: Submitting new tickets for the same issue automatically merges them into a single thread and often resets your ticket's position in the triage queue.
• Secure Your Original Email Immediately: Ensure the password for your personal email provider is changed and has 2FA enabled, as attackers often compromise developer email inboxes first to intercept password reset links.

Once GitHub Support verifies your SSH signature or original email confirmation, they will remove the unauthorized email address, issue a secure 2FA reset token, and restore your account access. If this guidance helps clarify the recovery process, please mark this as the accepted answer!