It's possible you didn't set up your 2fa right, every time I log in I'm requested for my 2fa code. Another security measure you can take is to add whitelisted wallet addresses, it does require a bit of preparation but that way you ensure that absolutely no one but yourself will get your coins out of your account.