They need more mods helping with this. If theymos is caught up doing everything else to the extent legit hero/legend members who have been hacked have to wait months to get their account back whilst that said account could be being used to defraud other innocent forum members then you need a few more mods with powers to

1. freeze accounts
2. transition those accounts back to the original user.

really the original email used to register the account should be held in a field on the db even if the user later decides to change it to another email address.

also email verification should be required to change anything about the account. Currently it seems hackers once they have hacked the user and pass here which may not be hard since they already have your username and two this kind of forum is not really that secure as has been shown on numerous occasions... they have full control of your account. They do not need to access to your email to have full control and use it to defraud and scam others on this board.