The account use manual recovery, so I think the person who control that account has access to the secret question/old address because
in this thread, they asked either one.
Secret question is not an option anymore since the data breach. If anyone ever tries to recover their account using a secret question, their account will be blocked. I tried it once, and my account was blocked. I had to create another account and prove the ownership to recover this account. I did not post a Bitcoin address back then. Luckily, I used an ETH address, and I was able to sign a message from my ETH wallet address to prove the ownership. Unfortunately, my ETH wallet got hacked later. But I was lucky that I was able to recover my account with my ETH wallet. I already staked my Bitcoin wallet again in case I get hacked again.
Welcome laszlo!
Can't wait to see you write a post.