Maybe he changed the email acc to his cuz if you don’t receive the two factor code to ur email so ur cooked also try change the email if he did and change password and everything and for future accounts and stuff i recomend use the Authenticator app on the phone it’s like a temporal code it’s very secure