If someone has access to your account and you had Authenticator enabled then they must have access to your Registered E-Mail address so they can disable it.
I would be checking the Registered E-Mail first and making it secure.
Also it's best not to post any personal details like your E-Mail address. That could give hackers a direct link to you and they may send you unwanted/needed applications that could cause your system security to fail.
Comprehensive Account Security