I wouldn't even call that "hacked", it's just phishing: the scammer sends a fake forum link, the user enters his password, and the scammer is in. Even 2FA isn't going to help against it, as the Man In The Middle can still use that to login.
I've been send to a phishing side once, and when it asked me to enter my password (instead of my browser doing it for me) I knew something was wrong.

One solution against hacked accounts would be to only accept signed messages and ignore anything else, but that's more work.