i really have no idea what sign message means/how to do that(if there is video tutorial , it would help more) ... why can't they just send "Verify Email" to the first email and that's it? The account had same email for over a year until it got hacked...
Too easy to change. Accounts are being sold with email, private keys and social media accounts.
https://bitcointalk.org/index.php?topic=990345.0