adding mail confirmations for withdraw will be solution
If the 'hacker' has access to the account, this means your email address could got compromised as well if he knows what your email address which is linked to the PD account is. The simplest solution to this is to force a 2FA for every account , this is the simplest yet the toughest thing to break for the hacker
Not necessarily. I use a different password for almost everything, as I'm sure many others do.
2FA is a huge hassle for people like me who barely use their phone and always lose the charger so we have to spend a whole shit load of time looking for it for a code.
You will be surprised to know how many people use almost the same password for everything, even if it is not the same password it will be similar so it will be easy for the hacker to compromise the email as well. Btw you dont need to put your 2FA code apps on your phone, you could put it in mozilla or chrome as well , more convenient