Social engineering is the most common cause of account hijacking with two-factor. Check this out: they used his cell phone provider to get at his google account.

http://www.makeuseof.com/tag/two-factor-authentication-hacke...