The problem is after I locked down the account with a new password and the 2 step verification, the account can still be moved with the old password.