In theory you need that mobile authentication, but I saw in the past, other people blaming valve because they lost their inventory after a similar scam where the "hacker" get inside their account at night and no authentication code was needed. I have no idea how they can do it, but if there's a coach bug, there could be a bug there too.
" Account/items stolen, mobile authenticator bypassed and email changed without consent, help on where to contact steam?
So on Sunday (April 2) my steam account was hijacked and stolen from me. I have since gotten the account back, but my $300 or so in CS:GO items were traded away from my account without my mobile authenicator asking me to confirm my trade. This is because my steam password and email were changed without my knowledge as well. I haven't been able to find anywhere to contact anyone or be able to speak to anyone to help me with this issue. I have read every article steam has about accounts/items being stolen and I had every security measure enabled, yet I was not protected.
I have screenshots of all emails, from my mobile authenticator device being changed to my email, down to Russian steam support telling me my password was changed successfully. I have screenshots of the accepted trade and items that were stolen, basically everything that confirms that my account was hijacked and my stuff was stolen without my consent or permission. If anyone can point me in the right direction I would really appreciate it "
It looks like if they can log into your steam they can bypass the mobile thing. So if the cxgomoney asked for his steam login or was able to get there if it was stored on his browser or something, maybe that's enough to do the trick.