Well that is the kind of thing they are trying to prevent with 2 factor authentication. Purchase transactions don't account for if you got those legendaries from those joker boxes.
They should be able to track the mail history and see that all your legendaries were offloaded for cheap on the marketplace, because mailing legendaries to other accounts is locked.
Depending on how long ago it happened, all they might be able to do is ban the person, you probably won't get your items back bro.
Kind of on you though, if somebody knew your email / you had a weak password, that was the problem, not Orbits problem. If you had any decent anti-malware program on your computer, its highly unlikely that you were keylogged.