[ss64]

If a new account has that much power to abuse the system, then your problem is not the 2FA security. They don't need to crack your account, a bad actor could just create a new account for themselves.