I don't get the discussion about 2fa and Google. You also can use "WinAuth" and has nothing to do with Google. You can use it on a normal PC and not a phone. Also OP and the other victims mentioned that they didn't use 2fa. The intruder only used 2fa to get the API keys for his bot. The IP numbers are in the logfiles. But IP numbers doesn't say a thing, more....doesn't say anything.
 
The question stays how on earth did the intruder get the login info.