A similar incident happened with my brother.
He logged in one day to find a char pass lock he did not set. He changed his password and sent in an RT. Took about a day to respond. They banned his account and emailed him a questionnaire to fill out and asked for a new email to assign his account.
He got his account back, but I don't know how he got hacked. Only lost a few MFIs, good thing he was already poor.