The strange thing here is if this was a hacked or bought account all three account would have changed their email or password
I'd say you don't necessarily need to change either of them. I've seen plenty of hacked old accounts with no records of email or password change.
Looking at btcdemon, he appears to be a native English speaker given the posts he has made between 2014-2015. Promoting some sort of a dice game called
BTCDEMON.
Archived seclog shows -
November 07, 2017, 07:12:25 AM - btcdemon - woke up After that, 4 weird posts made in 2017, trying to sell some scam ECH tokens:
Dear all member!
Demand for ownership ECH and lending is too great. So we will sell another 2 million ECH.
Bounty reports:
and zero posts made in English:
бнб xaйпyeт тaк нa фoнe нoвocтeй o ycпeшнo пpoвeдeнныx aйcиo нa coбcтвeннo плaтфopмe бинaнca. нo в цeлoм и oбщeм движeния зaмeтны.