That's what those hackers do. They no longer change passwords so that the owner of the account won't be alert through their email address that the password has been changed. All they do is log into the compromised account and the post links to malware
You are right, boss. Those hackers are very sensitive and experienced in the sense that they equally know that if they try to steal a forum member's account, they will not be able to prove themselves as the real owners of the account, because definitely the forum will ask for a signed Bitcoin message through the wallet that they have already used on the forum. Crazy things are happening these days, pioneered by these hackers, who always want to reap where they did not sow. I also saw the case of a member on this forum whose account was accessed and was used to collect a $1000 loan from Shasan. In that same case, there was no change of password on the victim account.
@Harizen, Things like these happen more often these days, and the way to prevent them is to always be cautious of activities, websites, apps, and programs that you run on your device. I wish you luck in getting your account back.