It's our mistake, cause exchange provide us to setup 2FA (SMS, Mail or Google 2FA) to access account, so it's our mistake to not setup it. If we setup 2FA then it's difficult for hackers to bypass it.