Thanks I get it now. It would be interesting to know if the chap who reported being connected to, with 2FA on, had restricted access via the whitelist or had left it the way mine was. I suspect the latter.

However I am so paranoid at the moment that I have decided to exit teamviewer completely between uses until this all blows over.

EDIT: In the comments below the linked article is the best explanation yet in my opinion:

>They sign into the website/client with the compromised credentials, and get a list of what computers are online and waiting for connections from that account.

http://arstechnica.com/security/2016/06/teamviewer-users-are...