It looks like whoever hacked your account is also contacting them to recover the account and link it to the old email.
This is an obvious flaw in their security system. The first thing they had to do, after you informed them about losing access to the old email and after they verified your identity, was to blacklist the compromised email or at least ask the other person to verify his identity too.

Asking for a written agreement between you and who is clearly trying to steal you is just ridiculous!