Admin looked into this.
According to him, none of the in last time hacked accounts had a second mail registered.
some had PIN deactivated.
Have no reason to doubt his statement.
Very high probability of misuse.
Own fault. No Refund. Case closed.
That sounds likely. It is sad, but people need to learn to be careful.