How can someone change my iCloud password within 3 minutes after activating Lost Mode?

My iphone Xr got stolen, and immediately it was switched off. immediately I noticed it was missing, I enabled the lost mode and was constantly watching to see when the phone will come back online but it didn't.

The next day, I received an email notification that lost mode has been activated on the device at exactly 16:47

the next notification that will come in was by 17:00 that my iCloud password was reset successfully and another mail at the same time that he had disabled find my and removed the iCloud from the device

First question is, is this possible if someone doesn't have my phone password?

Secondly, how come he was able to change the password within 3mins, I thought lost mode wouldn't have allowed him do that till after an hour?