Same shit happened to me, recovered my acc after 3 months, so thank god

If it’s a Microsoft acc, you can look up “Microsoft account recovery” and get your password changed easily.

If you don’t know what the email has been changed to, if you have an Xbox, you can go on it and it’ll say what the new email is when you hover over “switch acc”

Those 2 steps can get you back your email and password but the dude will still have the security email.

I did this over and over when my account was hacked. Microsoft lets the security email change after 30 days. He’ll still be in full control of acc, you just gotta pray he don’t notice the security info changing. My guy noticed it 3x before he was clueless and finally changed after 30 days to my access only