The SEC didn't have 2-factor authentication when it got hacked, X says