The most likely reason is that there is someone that used your 2FA to spend from your stake account. Either the person was able to access the device your 2FA app is or you used 2FA like Google authenticator. If you save your username, password and 2FA backup on Google cloud, only what the bd actor needed was just to be bake to access your email account. If you are using 2FA that your 2FA is backed up online or you backup your login passwords online, it is better you changed change the backups and deleted them from the online cloud.