Schmuck's Coinbase gets hacked

You've heard it a million times I'm sure. Some poor shmuck lost their crypto because they decided to put it on an exchange without listening to all their peers' various security advice. Well today, I'm kind of that shmuck. I'm not looking for sympathy, I'm not going to withhold information because I'm embarrassed. All I'm looking for is for smarter people than me to tell me both how this could've happened, and what I should do moving forward (in regards to other non-crypto accounts as well).

So here's the info:

I had Ether staked on coinbase for probably around a year or more, and I had two-factor authentication enabled, via the google authenticator app on my phone (I checked, and at the time of the breach, SMS 2FA was not enabled.) I have an iPhone, and it is never accessed by anyone else (unless a family member got to it while I was sleeping or something crazy). All other devices with Coinbase access are also out of reach of anyone and are accounted for. Now here is where there are possibilities. I have my passwords managed by google, (which is against the true crypto-bro code I know), and I have the google password written down in the notes app on my phone. I know that I'm not supposed to do that. As such, all passwords other than the google one are randomly generated and complex. If my google password is discovered, then the rest can be as well, but without the google password, I don't think anyone would really have a chance at anything with 2FA.

On the 27th, I received an email from Coinbase labeled " Your Privacy deletion request has been received", which told me to withdraw my funds and close my account or something weird. As far as I know this could be legit, because I completely ignored it as I was probably preoccupied with holiday activities. In fact, I basically didn't do anything or click on anything until January 5th. So that email is probably the first time someone else was accessing my account. The emails that followed were:

"Your Coinbase account has been locked" (Automatic it seems by the wording because they noticed suspicious activity.)

"Signin for your Coinbase account has been disabled"

"Your Privacy deletion request is complete"

When I finally went through the account recovery process Coinbase wanted me to do, I entered back into my account to find that my funds were gone, but here's the thing:

They weren't sent. They were wrapped, sold, and then the Fiat was withdrawn to an unfamiliar bank account that had my name on it apparently.

Is this identity theft? Would it be useful for me to contact that bank? How could something like this happen?

I'm not claiming that there aren't holes in my password keeping. I'm sure this is possible. Just, how?

Thanks,

Schmuck

Edit: I have contacted the bank that the money was sent to, and they couldn’t find an account with my name in their system. The money was withdrawn to a bank in the Eastern US. It’s smaller, and has about 19 branches.

Edit: I know that everyone's first reaction is that I fell victim to a phishing email, understandably so. I would like to clarify these facts, though:

1. Although my account has once again been locked while I communicate with Coinbase, when I did recover my account, the activity seemed to line up with the emails.

2. Every way that I have been recommended to check the sender's address appears to reflect a legitimate Coinbase email address.

3. Possibly most importantly, I am 99% sure that I didn't even open these Emails before someone was already in my account. During this time I was not checking financial accounts and I certainly wasn't concerned about Emails from Coinbase or whatever else.