There has been malware in the past which changes the address the user sends to at the last minute so you don't actually know till the tx gets sent off so you might want to check for that. That being said, in all likelihood you probability you had your details stolen/phished so if I were you I would learn the lesson and run a non-online wallet that is encrypted. If you want to be more paranoid just buy a raspberry pi and use that with Armory/Electrum and sign your transactions offline - significantly safer. Just need to worry about physical security.

You should always take advantage of two factor. I don't think the few seconds it takes to type or copy and paste a short code is much of a hassle and those few seconds would've probably saved your funds. The only time I ever see people's bc accounts getting hacked are when they don't have 2 factor set up.