Three days on how passwords get cracked, how a second step proves it's really you, and how to take an account back after a break-in.
Approve only the sign-ins you started.
Clean out three recovered accounts and check the attacker is gone.