A user being phished (assumption) while not having 2FA enabled does not mean that the exchange was hacked.

BTC withdraw verification via email is not 2FA.