Are you sure your metamask has been hacked ? Metamask doesn't use private key or keystore file to login,
so the phishing hacking case is unlikely. Where do you use metamask ? In your PC or notebook ? Is there anyone else who have access ?
sometimes peoples near us can hack our wallet if they have access on our PC or notebook.
yes it looks very strange in my opinion ... I think it's not cracked but maybe the PC that he has is a virus or maybe one of his close friends knows the wallet password so it's very easy to access the contents of wallet