I remembered hearing a really great presentation where the person, I forgot his name but he was very knowledgeable about IT security said that 2fa is useless if you have an infected PC - Man in the Middle attack will login with your 2fa and initiate a withdrawal in the same execution timeframe with the same 2fa key - I think that laymans explanation of what he had stated.  It was basically that, if you're using a malware device on either end, the MITM attack would exploit your key like an elaborate phishing attempt of sorts.

Your QT was emptied because of of the new password request.  which was obviously a spoof - it could have been tied to the other mitm attack that caused the mt gox withdrawals - if someone else has the correct or a better explanation, I am all ears.