Recovery Contacts, which lets a trusted friend verify your identity for you, is just one of Google's new security features.
Android devices are vulnerable to a new attack that can covertly steal two-factor authentication codes, location timelines, ...
Google has only partially mitigated the attack, which involves using a malicious Android app to secretly discern the two-factor codes generated by authenticator apps.
Contact your mobile carrier directly. Inform them that you suspect your number has been swapped without your consent. Request them to suspend your account, cancel the transfer, and issue you a new SIM ...
To enable two-step verification on Telegram, go to the app's Privacy and Security settings and follow its prompts.