His account is not hacked... people reset passwords from time to time, that's not new.

Your addresses are linked through an extended public key which means they are owned by one person.

How is it possible for 2 different people to own addresses under the same xpub key?
Can you explain how it all came to that?