As we have explained to this user over email, his account had the email changed by using our "change email" feature that requires the user to have access to the previous email to complete the process.

We also offer 2FA but the user did not had it enabled in his account.

We are not responsible and cannot prevent an attacker if the account is not properly secured and the attacker has access to the users email, if you want extra security please enable 2FA.