If it only asked for your 2fa once, are you sure you were on hitbtc.com and not some phishing site? It could've been redirecting your profile to you over and over and when you logged out it had all it needed to try and screw you over. Good thing you didn't lose anything but there's a bit more to the story that we may not be seeing?