Bittrex prompts a verification every time you use a different IP even with 2FA enabled. My internet connection is dynamic IP so I go through this virtually every log in.

But I would advise in any case to change passwords, put 2FA on your email if you're able, and in future trust NO ONE with your personal credentials. Especially a female unless it's a family member (no sexist provocation intended). As others have said, Ex-girlfriend or friend with benefits or anything of that nature could put you at high risk.

Even though she doesn't have your email, she could get it from the personal info section on your Bittrex account. If i'm not mistaken that's your user name clearly written under account summary (well mine is). And holding your ID could give her unauthorised access to forgotten password requests on email etc.

Most exchanges require you to submit a selfie of you holding your ID, so her options are limited in that regard.

But be careful dude.