Is your Authenticator still active or has it been disabled?
If Authenticator is still active, it means you have been tricked into giving the hijacker direct access to your device and ip.
If Authenticator has been disabled, it means your email is insecure and the hijacker has used access to your email to get into your account.
To review the security of your device, work through these instructions:
Securing your device
To review the security of your email, change its password right away and work through these instructions:
Keeping your email secure
If you have been tricked by a phish, read this:
Fake websites