If hackers brute forces it, he probably have the private keys, the best practice to follow is to create a new wallet, after you format your PC if you don't have any important documents there.
The OP is talking about Blockchain.info a web-based wallet service, so you obviously don't enter your priv key rather your password.
Yes but the hacker can have keylogger, so they check when OP logs in and get his private keys. In this scenario, nor 2FA nor EMail confirmation helps you out cause he can do whatever he likes with OP account. I thought OP was hacked, if not then I am very happy for him.