PayPal hacked, no idea how

My partner's PayPal account has been compromised somehow, for weeks she's been seeing small transactions to steam and other gaming platforms. The account is secured with 2FA, the email address associated with the account has been changed and there's no other devices reportedly accessing the account.
The one device with access to the account is her mobile phone which I've ruthlessly scanned for malware, coming back clean.

The only thing I can think of is someone is somehow accessing the …

2fa access account address compromised device devices email gaming hacked partner paypal platforms privacy steam transactions