Got an email from Binance saying that I requested a password reset - I did not do this

Got an email from Binance: "You've requested to reset the password linked with your Binance account."

I did no such thing. I've since logged in and changed my password, so I think I'm probably safe (I also have a 0 balance so whatever) but this is still alarming being that I have 2FA enabled with Google Authenticator.

So, how in the world was someone even able to make this reset request in the first place? The email contained a code to confirm the request, so it seems that if this person also had access to my email address (I don't believe they do, the passwords are different) that they could have completely bypassed my 2FA and changed my password?

What kind of mickey mouse security is that?!