scammed by a scammer
Yep, you got scammed all right.  Sorry to hear about that.  As I suppose you have realized, everything the guy told you was total nonsense.


  perhaps there was some crypto-key he accessed and was then able to take the money out. 


I think that's exactly right.  Blockchain.info lets you (i.e. the person with the password) retrieve and back up the private keys and wallet seed for the addresses in that account.  Having the private key for an address always allows you to spend money received by an account; if you have the private key you don't need any other passwords or anything else.  Keeping a backup of the private keys guarantees that you will have access to all funds received in that account, now or in the future, even if you forget your password, change it to something you don't know, or if the blockchain.info site quits working.

Of course, when someone else has the password and uses it to get the private keys, they get this same power, and can spend the coins even if the password is later changed.


  i think BLOCKCHAIN Wallet should plug that hole ! so it doesnt happen to more people


I don't think they should, since as I mentioned above, if used properly, it's not a hole, but a safety feature.  One of the things that many people like about Bitcoin is that it's decentralized - your control over your funds is not dependent on any one company or government.  Having backups of your own private keys is a big part of that.


  so i have changed a bunch of my passwords, etc, hoping that's the end of it. i had my cellphone listed in the verify section etc. so i went in and put in another number hoping that stops anything there


Caution.  The scammer still has the private keys, so he still has the ability to take out any further funds you might put in that account.  As you saw, changing the password won't help with that, nor will the two-factor authentication.

The best thing to do would just be to never use that blockchain.info account again.  If you still want to use the site, make a brand new account.  (There might be a way to reset the private key - I am not sure - but I would be reluctant to try that unless you are sure you know what you're doing.)