That really sucks. Unfortunately, you're not getting the funds back. There is no insurance on Coinbase's BTC, and even if there were, they couldn't insure against your own account security (e.g. if you get hacked). There is insurance on USD held on account (standard FDIC insurance). But if someone hacks into your account and buys BTC with your USD and withdraws it, it doesn't apply.

Technically, there's no way to verify that you didn't withdraw the funds yourself. For example, you could have set up a VPN to appear that there was unauthorized access to your account from, say, Russia, and you could do this for your email as well. If 2FA was via SMS, you could also have your number ported and give the appearance that the porting was unauthorized.

If Coinbase simply refunded people in this case, they would quickly find themselves bankrupt. If there is a security lapse on their end, they might be liable, but in this case, there is no proof of that.