Two factor authentication is very hard to keylog, since you can't use the same code twice and has to sync to the code sent by the server with the handshake. To me, this smells very fishy and quite suspicious.

You're getting duped, simple as that.