adding mail confirmations for withdraw will be solution
If the 'hacker' has access to the account, this means your email address could got compromised as well if he knows what your email address which is linked to the PD account is. The simplest solution to this is to force a 2FA for every account , this is the simplest yet the toughest thing to break for the hacker
Not necessarily. I use a different password for almost everything, as I'm sure many others do.
2FA is a huge hassle for people like me who barely use their phone and always lose the charger so we have to spend a whole shit load of time looking for it for a code.