Given it's a team account might have made usage a bit more complicated, but this sounds like something 2FA would have prevented, as even with the passsword the hackers wouldn't have been able to login.