I just looked up un4given.1991's support ticket, his email had been hacked and the hacker accessed his account that way to send the funds (they were sent to ShapeShift.) HTTP logs showed the hacker doing a password reset then logging in with Email 2FA and doing email confirmation of the withdrawals.

We do highly recommend enabling Google Auth/TOTP on all accounts so there isn't a single point of failure on your account.