Too bad, another negative point added to web wallets, at the same time proves the fact that "Not Your Keys, Not Your Coins".

However, we can clearly see from these instructions in the link above that in order to disable 2FA you must have a "wallet identifier and the email address associated with your wallet". This means:

The person who managed to disable 2FA has this information, so it is either a hacker who managed to hack your device and access your data or someone very close to you who can access this data.