I am not sure if i get you right, what do you mean by the email address expired?
Are you trying to say the hacker got hold of your old email address you used to register the account?
What I mean is that I bought a VPN and I received a free email, then at a later time the promotion expired and the VPN eventually stopped providing me that email, I stopped having access to it and the data in it was most likely erased, then at a some point the hacker created that same email and use it to reset the password by email.
Also signing a message from an older Bitcoin address is much more better like this address 14Ff7YBLb4N5QTdE596e8zpFgZeZfLvcgZ
If I am not mistaken that address belongs to the online wallet blockchain.com, formerly blockchain.info, so I cannot provide a signature for it.
However I think I can provide a signature from an address that is older than the one I provided already.
I am looking into it.