If there is activity on your account that you don't remember doing and you already had enabled 2fa, then someone has accessed your already authenticated session. That can be done either by physically accessing your device or more commonly through malware and malicious programs. There are a lot of unauthorised and unofficial programs and apps for our site to our site and other Bitcoin related services that conatin tojans for such activity.