You can't log into poloniex untill you confirm 2factor with email in first place though.Also you must click email confirmation before they allow withdrawl of funds so hacker must have had access to your email at the same time?
Well, he created a ticket to withdraw funds. Perhaps the notification of the withdrawal did not come to the e-mail.