I did have a 2FA password enabled. They by passed it completely. When I saw 4 new login sessions with changing IPs I immediately tried to terminate all the sessions. It wouldn't let me saying that my session is not old enough and that I need to wait a few hours.