Whenever this kind of things happens. It will make all the more difficult for startups to acquire users because this reiterates "Startups are either going to be acquired and killed or die prematurely".
I have successfully used an Android device as a cheep SMS gateway. An app installed on the device acted as the gateway and messages are triggered from the server via GCM push messages to the device.
Incoming messages to the device are intercepted by a receiver on the device and posted back to the server.
I already have MFA. Looks like you didn't get my question. How are we going to prevent anyone from using your email id in a signup form for some service? Spammers/abuser don't have access to my email account they just use my email id. What seems to be happening is some spammers creating fake accounts for services using randomName@myappsdomain.