He might be lucky that the hacker didn't change his account email ^{[or the new owner didn't change it]} so he might still be able to reset his password via e-mail. This user-generated recovery does not involve the account recovery team as the account owner only resets the password via a link sent to the e-mail to reset the password. But it will be very difficult if the hacker has changed the account e-mail because the account recovery must involve the recovery team, and the only way to get the account back is to prove it by signing bitcoin message.

Imagine if a user never used a bitcoin address anywhere on this forum or he forgot about the wallet he was using. It will definitely make it even more difficult to get his account back ^{[perhaps not even anymore]} because the recovery team won't trust him as easily as one might think.