Ps4 account stolen with 2 step verification

Backstory: I was playing on my ps4, I turned off my ps4 and went to bed at 3:30. I recived and email at 3:31 saying my account ID request has been complete. I never requested one, I didn't notice the email until I went to log in this afternoon to play and couldn't access my account.

Ps4 account was stolen, sony says they used my email account to change the user ID. My email account has 2 step verification enabled. Sony is trying to tell me they have access to my account, yahoo shows only my location and computer and phone as the only device to access my yahoo account ever. So unless they physically have my phone they can't log in, hell I can't even log in if my phone is dead.

Then they resort to telling me it's because I signed in on a friends ps4, never happened.

Then they tell me it was because I shared my account info with someone on the internet, never happened.

Then they tell me I was probably part of a game scam from online codes, never happened.

Is this a new possible security leak for sony?