I had this same thing happen at my company, Godaddy somehow allowed someone to disable dual auth through social engineering and reset our password through a compromise email. They proceeded to initiate a domain transfer. Not sure how Godaddy would allow disabling dual auth over the phone.