Why was an invalid cancellation request processed?

Yesterday I was alarmed to receive an (apparently legitimate) email from Xfinity claiming they had processed a cancellation request on my account that would take effect the same day.  This was a huge surprise since at no time did I or anyone in my family attempt to cancel our service.  I was able to connect with an agent who managed who put a stop to the cancellation (which would have been catastrophic for us since our Internet service is what allows us to work from home).   

Here's my question - with 2 factor authentication enabled, and having to jump through hoops in the past just to remove a premium channel from my TV service, how was it so easy for my service to have been 'accidentally' cancelled or a request to cancel processed from somebody other than me?