The only dilemma I am having right now is even if someone have cracked my email and password and logged in, Still Stake asks for 2FA while withdrawing.
How did they passed that..?
We do not have access to the behind the scenes, so cannot determine how there was a breach of the website. You can only get that response directly from a representative of Stake.
Isolated cases like this are not uncommon with crypto related websites, it could be due to a hack or you allowing someone else access to where you keep valuable information.
If you do not get a substantial answer after a few days, then you can try calling then out on other websites they are active on.