There were a number of ScubaBoard wannabe forums. They thought they could do this better than we were doing. While they are gone, their databases are being sold and shared. People often used the same usernames and passwords across these forums. So, when they find one that's the same, then bang they're in. 2FA authentication would deny them access to your account. Without access to your phone, they have no way of entering. I use Google's "Authenticator" Google Authenticator - Apps on Google Play and have it on my phone, my laptop, my PC, and my tablet. It's really, really easy and adds an amazing level of security.