I too feel very sorry for the op and in addition to the excellent advice already given note that regular contact centre staff won’t be able to give you updates on the case and the people investigating it won’t be reachable either. So part of the stress will be a sense of powerlessness and not being able not only to anything but also to communicate.

And I’m with others on basic steps, eg:

- make it impossible to change both email and phone within a week of each other without id check

- generate confirmation code via email to change phone number and via phone number to change email

- no transactions allowed online for 72 hrs after email change except flight bookings where the account holder is travelling (so no transfers, spend for others, spend on third party awards etc) and id check to do so offline.