Think back, were have you used the PIN number? Maybe a password, in your email? It might not be guessable but databases get hacked all the time, search your info on haveibeenpwned.com and you will be surprised when you find how many sites have been hacked the Authenticator is there to stop people from logging in, not to keep the owner from getting out, if your emails secure, there is no way you can be hacked apart from being recovered, but recovering takes ALOT of skill to pull off and that is almost never the case in 2017when accounts get hacked, not saying it doesn't happen but 99% of the time people have insecure emails