I enabled 2FA because support recommended it after the last time (about 2 years ago) and because I was tired of dealing with this, so now it requires a code anytime my IP changes. Anet's master account keeps all prior used IPs on a list until you manually clear them regardless of if 2FA is enabled. Since the support guy I spoke with told me he cleared the allowed IP list, I assume that was how ANET was spotting the "foreign logins". Since then I opt to clear that list of all but the newest code in a paranoid fashion. My logic being "No old IPs logged, nothing to compare the new against."
Whatever the case, if I took support at their word and I was actually compromised, then I should have been cleaned out of all my wealth, yet nothing was touched.
They were essentially asking me to believe that *somehow* a hacker got ahold of both my email address and password (unique and unguessable, never shared before or since) and yet never took a thing, never deleted a thing, never even moved a character after logging in. They were asking me to believe that this hacker was purely after access to.... an account for an utterly dead game... even though to get that info they'd presumably be able to steal other far more sensitive information, pin numbers, bank accounts etc. just as easily via keylogger of whatever other method they supposedly used.
I assumed and still assume that either their own database was compromised again, or that they flagged one of my own logins as a false positive. The alternative is too fanciful, since it's only ever been Anet. Just Anet. Never any other MMO, service or account. Never even the ones with weak-ass passwords I made when I was 16. Never Turbine, Cryptic, Blizzard, Bioware, Riot, Steam. On and on, ever and anon only Arenanet.
