You had 2FA enabled on your exchange accounts right?*
* (Of course not the question was rhetorical for any noob reading every single one of these stories has the same thing in common - no 2FA).
Any additional information on "2FA" would be appreciated.