Sure hack had been server side not from email or....
can you show the address that your bitcoins were sent? because honestly I don't like how blockchain.com provided services in the past (I say in the past because I haven't used Blockchain.com for more than a year), they made me stay many days to unlock the 2Fa sms and it was terrible days for me and after that I stopped using blockchain.com, and I had more than 7 attempts by someone to want to break my password, sometimes I would use my cell and via 2Fa sms with the code, I already knew that someone tried to get into my blockchain.com wallet and when I was going to see my email, there was also information about someone trying to get into my wallet