For any mission critical applications, lately I have been using a server-side generated "magic hash" key that I generate when the form is loaded, and which gets posted along with my forms.
That's not a bad idea, but it wouldn't have helped here. This sounds like classic MITM.
The two-factor authentication solution should reduce the damage from this attack. The phishers probably made some cash from this scam, but once the site was taken down the game was over. They shouldn't be able to use the stolen passwords without the tokens to go along with them.
Regards, Brian