We face same problem this time one of our member of bitcoin in our relatives has been, they same what happen to your MEW account. She always doing airdrop since the start, I never teach them anything so I doubt in airdrop that send through email. So what we do is we donate her account little by little ETH so we can transfer her token faster before the hacker will get theme all. We discover to late almost all potential token has been transfer but we try all to transfer in the new MEW. When we search the MEW of the hacker it has comment in their. We really don't know how did he/she access the MEW of our family members.