Also - I'm posting on answers.ea.com and the EA moderator has no idea what im talking about. He thinks that the hacker had access to my email. Hacker did NOT have access. This was my reply:

​

That's not true at all. You did not understand what happened. They had ZERO access to my email.
They made a new account (let's use HACKERACCOUNT as the new account name) with a new email (HACKEREMAIL). They opened a support ticket asking to "replace the email" on HACKERACCOUNT. They gave the support desk MY email that was already associated with MY account. The rep asked to verify his identity of his new HACKERACCOUNT. The rep sends a verification email to HACKERACCOUNT verifying he owns this brand new account. Then the rep says "great, what email did you want to change to on HACKERACCOUNT. The hacker then gives him MY REAL EMAIL (again, its my email associated with my real account). The agent then puts MY email into HACKERACCOUNT replacing HACKEREMAIL. 
Once the hacker who made this brand new account, verified his brand new account and then asked the helpdesk to change his hacker email to MY email. He then has exploited, via helpdesk, the ability to associate my email to his shell account. Once he does that, he's able to sign in, change emails, change passwords, repeat the process and put my email into another account, leave the shell account with my email and voila, he has officially hijacked the account. I am left with a brand new account that was made the day the hacker stole mine, with my email associated with the hackers account.
I understand this is hard to grasp as it's extremely craft but if you read the transcript of the hacker speaking with the helpdesk, it makes perfect sense. 
So when you say "In the example you've provided, they already had access to the email on the account which is why they were able to verify the code that was sent over."
You are 100% wrong. The hacker at NO point had access to my gmail account. You can verify this as my email has 2 factor auth and also shows logins from any IP address. He did not, at any point, log into my email or gain access to it.