An unauthorized user accessed my GoDaddy account just under a week ago and registered Cloudflare as the authoritative DNS source. They registered a bogus, AWS compute node as the MX server, etc. I have since regained control of the domain and re-created the main parts of my DNS configuration back on GoDaddy but I see that the bogus records are still active on Cloudfront NS nodes. How do I request that my domain be removed (considering the domain no longer points back to Cloudflare)?
You can always contact support, however Cloudflare will eventually drop your domain anyhow as the nameservers are not in place any longer.
It has been 22 days and the Cloudflare NS’ still have the bad data. They won’t even resolve other host records from my domain’s authoritative NS list.
That can take some time. But why is it an issue for you in the first place? Considering your domain does not point to Cloudflare, it is pretty irrelevant whether they still carry some records.