Just a quick update. I am in contact with stunna about this. I spoke to support and finally spoke to someone who didn't just copy and paste a reply. They confirmed to me that whoever had access to my account would also need acces to my emails.

Stake sends a 1 time code every time you start a new session from a different device. I have 2fa set up on my email and security alerts so someone would physically need my phone in their hand to access this. As i had my phone in my hand playing it would have been impossible for anyone to access my account.