This sucks that it happened. If anyone ever finds themselves in a situation like this, go to your email and click on the disable account link in the login mail you received. There is no reason to sit around and try to out think/out speed the attacker. Disable the account, cut a support ticket, and we'll work with you to get it sorted out.