You should definitely start changing your passwords though, because the wallet changes were confirmed via email, meaning the person has/had access to your email. The wallet was not locked.
I read thru the Support link and see how the address lock works but I don't see anything on how the email lock works, i.e., once locked can it be changed and how?