in my opinion, both of them made a mistake,
your mistake is that you didn't protect your account, a mistake in return for leaving the hacker free, which should prevent them from moving,
For prevention efforts, you should protect your account, keep a good private key, use your account, authenticate Google, use anti-phishing