[fragsworth]

How can this possibly work?

Even if an attacker gets the phone code, they should still need your password to sign in. How do they get past that?

[kinofcain]

As ams6110 noted, it's likely not a 2-factor auth attack but rather a password reset attack.