Not really. When the guy had regained control of the account he could have signed out all other sessions, requiring all sessions to do 2-factor auth again. But

Not really. When the guy had regained control of the account he could have signed out all other sessions, requiring all sessions to do 2-factor auth again. But if the person re-authenticating has a trojan on their computer (as may have been the case here) there is _nothing_ that can be done to prevent a third party from accessing their stuff.