Wallet got unexpectedly hacked and funds withdrawn

I live in a country with no international creditcards/debit cards and to be able to make payments for services and/or goods I have to use platforms like bitnob, hyperpay etc. I used hyperpay for a year but it's a sketchy company and the fees are too much. I then went to bitnob which was fine at first signed up and deposited 30 usd to issue a card and I used it to make payments and purchases (usually when I set up platforms like these I deposit just a small amount, I am going to use so I only have a couple dollars all the time nothing much) due to this when I signed up I was lazy to set up 2fa (I know big mistake, lesson learned). Today I got a notification that my account was charged for Netflix which is my transaction subscription renews today. Shortly after I got a notification of a declined transaction for THUNES DROP and a gift card website, I immediately knew someone was trying to steal money so I deleted the card and withdrew the funds. Initially I assumed my card details got leaked but I have only used it in Netflix and Google wallet so I was confused, anyways I create a new card and deposit the money I withdrew from the old card into the new one. And I go back to doing what I was doing. Then I get a notification from the app that the money I put in the card was withdrawn to the app (so it's available for direct withdrawal) when this happened I immediately knew it wasn't my card details that were compromised but the bitnob account. So I started trying to change my password but it won't change then the attacker changed my email to a temporary email so I couldn't login, so I used my username (luckily I remembered it) and logged in then I saw the money hasn't been withdrawn yet, I couldn't withdraw it bc I have to add a wallet address and to do that an otp is sent to your email in this case the attackers email. So after talking to support to freeze my account (which they didn't do in time) the attacker withdrew all the money to an external address. Here is where things get interesting I blamed myself for not setting up proper 2fa and luckily 17 usd isn't gonna do much damage to me so I was about to take the L and forget about it but then I tried to change my email and I CAN'T, asked someone I know who uses bitnob to try and change their email and they can't as well (their account hasn't been hacked or anything) so how TF did the attacker change the email if users can't change the email. So I checked the attackers wallet address on tronscan and see it has multiple transactions including mine coming from bitnobs address. So could this be an inside job? I blamed the 2fa at first but this looks crazy sus here is the address

TBpTj2Q6kBsk5buPHvNCZ7YGKAcHoQfSGR

Go crazy with it and see if you can figure sth I haven't.