If recovering an account was easy, then the above would be all it takes. Account recoveries are seldom straightforward, they take time and precision but it's ultimately in the rightful owner's benefit.
I'm pretty sure with my recovery request topic I've created in meta should be enough to make his signed message not valid/legit, yes?
Anyway, he probably ran away to another bought account though, he's still online without any sign of new post being made
You could always contact the person who quoted the address to delete it. Point him towards your recovery requests/signatures and then delete the message yourself. You've already proven that your the rightful owner and it's probably best to try and get that removed for later on down the line someone may request you to sign it. The hacker could also try and link to that and sign the address to 'prove' to others than are not informed about this.