pretty sure they got the email address as well. When I noticed, I checked the security log and seen the password had been changed "via email". Not an option.
That, and the email providers recovery options are dysfunctional to say the least..
I've asked a DT member to tag the account with a response that I would certainly expect. They wouldn't because i never staked an address. therefore, I couldn't prove its mine.. Which is correct, though it is mine.
I post this to warn you (the community) that the account is compromised. Provable or not. And yes, I would love to see it deemed unusable to whomever is in its current control.