Update: My four-letter username finsta has also been hacked. (even though it also has two-factor auth turned on) (Jane Manchun Wong)