MITM is going to be unlikely - the bank should have a SSL connection with a signed cert from a CA, which would alert you with a big red screen and scare you away. It is also possible that you were re-directed to a non-secured version of the site (and a fake/look-a-like site exists), and proceeded to enter your info there, but this should quickly raise red flags with the bank (and while it may not being up the red screen, there should still be some signs, like the missing padlock, to alert you).
What is more likely is some sort of virus on your end that can either install it's own bogus CA and then proceed as above, or hijack the session by stealing the authentication cookies or similar.
It's also possible that the bank itself had another vulnerability elsewhere - this would probably affect multiple accounts, but you may be oblivious to the fact that others had similar issues (but hopefully the bank becomes aware).
You also assume that a MITM attack could only happen when he was logged on - but this may be a false assumption - would a MITM attacker pass on the "logoff" request? I don't see why they would - what if they extended the banking session each time (going to a new page/etc.) instead of allowing it to time out? - unless the bank at some point asks for the password/code again (unlikely from a UI perspective), then chances are you could be unaware that you are still "logged in" (although the bank should have logs as far as when you logged in/out and can check for this kind of stuff).