Password was hacked

Ok, here is my story - looking for info and/or advice.

My Xfinity email account has been hacked several times over the past year. The last time (5 months ago) and yesterday, the hackers were able to use the email account to gain access to my Dropbox account.

Last time, I enabled 2-factor security in Dropbox with both a mobile authenticator app and physical security keys.

Yesterday, my Dropbox password was hacked and changed...

I knew it was happening because I was aware that my email was being hacked and was literally dealing with it as it was happening.

I realized that my Dropbox password was changed and I immediately changed it again. I WAS asked for 2-factor verification using the mobile app. I might have been asked for the security key, too - I don't remember exactly as I was dealing with several things at once. Point is that I WAS asked for something 2-factor to authenticate and allow the password change to occur.

What I find troubling is that "they" were able to change the password/gain access to my account with 2-factor in place... Isn't that the whole point of having 2-factor? A physical "key" which you must be in possession of in order to make certain changes to the account???

I chatted with Luis in Customer Support - absolutely NO HELP WHATSOEVER - basically stated "no idea how that happened" and said that the problem was probably my computer's security or that I had used public wifi... Public wifi never happened. I pressed him to escalate the case or forward it to a security team (does that even exist??).  He asked to move the chat to email - I suspect as a way to get rid of me..

Any info / advice would be appreciated. Thanks for your time.