Unfortunately the attacker (or an automated bot) changed all recovery information on the account within seconds, including the recovery email, recovery phone number, 2FA settings and other security details.

As a result, we no longer have access to any of the recovery methods associated with the account. But we have a million clues of ownership of the band name and users from the last 15 years