We operate on Paxful from very beginning, had 2FA activated and never had any problems.

There has been a lot of phishing websites simulating Paxful, thus your user credentials might have been easily leaked.