Do you by any chance use Windows 10? If so there is probably some new 0day malware going around where you might of had someone gain access to your PC. If its not that did you reuse the same username and password on any other crypto sites? If so then most likely one of them was hacked or they were a scam site just to get your information.

This is why you always need to enable 2FA. Because these days you can never be too careful. This is why many banks and email provider provide 2FA service because its not only related to crypto security.

Wait until the support gets back to you, who knows. Maybe it was some error on their end. But in the future always enable 2FA, all you need to do is scan a QR code on your phone and put in 6 digits afterwards. Doesn't take too much time.