The SEC said its MFA had been enabled but was disabled over the summer until that fateful day when its account was compromised on Jan. 9.