If you genuinely think that someone has your Miles + Bonus number and/or your email address and is "maliciously" locking you out of your account, then perhaps the best thing for you to do is to consider terminating your membership (Terms & Conditions, Chapter 1, Point 13).

Once your account is irrevocably closed, you could then open a new one - using a new email address specifically created, and only ever used, for this purpose (and which your tormentor won't ever know)

It is not allowed to have more than one account at a time; and if this occurs, it is the oldest account that is retained (Terms & Conditions, Chapter 1, Point 11). That is why it is important to terminate the "problem" account before opening a new one.

Of course, terminating your membership has its consequences. Do you have a lot of miles accrued? Can you spend them, or transfer them to a trustworthy person (family member) with another A3 M+B account (fee: €15, maximum transfer: 50,000 within any 12 month period). Do you have status?

However, if you do create a new account, be aware of your details falling into this same person's hands. Don't discard boarding passes or luggage labels/receipts in public places; all of your details can be gleaned from these, so bring them home and destroy them appropriately (I shred everything). Don't post photos of your boarding passes on social media - it's surprising how often you see this, and even if the poster obscures parts of the text, they often post the barcodes/QR codes from which your details can be read by anyone with a smartphone. (If someone is continually doing this to vex you, it's likely somebody you know). Don't attach any the Gold/Silver luggage tags with your name and number to your luggage.

However, it's strange that you don't get two-factor authentication requests sent to you when this person locks you out of your account. Have you set this up?