You are quite lucky that the hacker didn't completely lock you out of your account by changing your email address after the password change or use it to scam unsuspecting members.
Try to keep your email address very secure. 2FA should be a must. Once your email address is compromised. Every account linked to it including exchange accounts could easily be accessed by the hacker through password resets.
That is what boggles my mind that someone got in DESPITE 2FA being active on ALL my accounts.
And google defaults to the new way of 2fa where you get a notification screen where you have to approve that you're signing in from a new device - I didn't get any of that when the hacker got into my email in April.
I was only notified when my DDIM tokens were being unstaked and I got that notification on Telegram. But It was already around 50 minutes late.
PS: I was stupid enough to have saved my master priv key sheet in the drafts of my email around Feb when I was doing a PC OS upgrade. And didn't care enough to delete it later.