I assume your new phone had the same phone number as the old phone, so they just had to text you at the number of the stolen phone. You cannot lock the phone, but you can ask your carrier to blacklist the IMEI. That will prevent the phone from being used anywhere that subscribes to the blacklisting service. However, not all carriers do, and professional thieves know all the places that don’t.
If you haven’t yet you should go to https://appleid.apple.com and change your password. However, as the thief had access to your Apple ID they may have changed the password, and the certainly downloaded all of the information in your iCloud account. So if you can’t log in contact Apple’s Account Security Team→Contact Apple for help with Apple ID account security - Apple Support