The database was hacked a few years back, it seems the hackers are now decrypting the passwords used. Mine was hacked a few weeks back, this is a new account.

I'd like to see a mechanism whereby if any ONE of the following details are changed, then NONE of them can then be changed for a minimum of 7 days:-
Password
Password hint/recovery hint (if implemented)
Email address

That would give the account owner (who will have received email notification of the change) a chance to undo the change (link in the email) and reclaim the account without having to bother the admins.

Did you follow the link in the notification email? That will have let you lock the account at least.

You should've received an email to the old email address when the scammer changed it. There'll be a link in that email which will allow you to lock the account within 14 days of the change. It won't help gain access but at least it should keep the scammers out.

Here's what I received (with link redacted):-

Same here, account was hacked last weekend and taken over by sergun1646@yandex.ru. If the forum had a built-in delay between password changes and email address changes (say 7 days) I could've reclaimed my account. As it was both were changed within seconds of each other so all I could do was click the link in the address-change email notification and lock the account so nobody else could use it. I've had to set this up as a replacement now.


There have been several recently-posted cases in the forums of accounts being hacked. I guess it's all a coincidence and we're all just "losing" them, eh?

The email address as always been hidden and was only used for this forum (I have the whole domain to play with so I use different addresses for different sites which allows me to identify where spammers got my address from).

From haveibeenpwned.com:-


Hack was taken a step further on the weekend, where my account was logged into, the password changed then the email address changed to sergun1646@yandex.ru. The email notification of this change included a link to lock the account, so at least the hacker shouldn't be able to use it now. I've also reported the email account to yandex.ru and their IP address (with date and time stamps) to their mobile ISP.

My account was hacked on Saturday, I had email notification firstly of a password change, then of an email address change (from my own to sergun1646@yandex.ru). Fortunately that notification email comes with a locking link that lets you shut down the account so at least the scammer's been locked out of it, but as I've not used the forum for any sort of trading I don't think I'll have any signatures, etc. that can be used to verify it as mine, so I've had to create another (this one).