Hi. I was in a very similar situation this weekend.
I have a old account that I forgot I had with a very stupid password.. I'm not that person anymore ahah.
I've received a email from apple saying that my billing information was changed.
I can't say for sure if the security questions were changed or I can't remember that, but still I was not able to retrieve them. And was not able to login to apple account (web) because I didn't have the answers ( I was also not able to change them, "not enough information")
Still if the hacker did not added a a phone as double factor authentication you may still be able to retrieve control of your account.
Apple Support was no help at all because they said the only way to get control of the account was to setup double factor authentication, at 1st was not able to do it because the region was changed to mainland China and I don't have any Chinese number ..
The call was ended with the woman saying the account was lost forever...
I was not happy with my email and information to be in the wrong hands.. with 4days searching for a way to solve it i managed to do the following.
Reseted your password via your email. (Immediately after receiving the apple email)
Using an iPhone from someone else I logged in to media and purchases apple account.. (all in Chinese now, I had to use google translator)
Navigate to region tab and select my country. (Not easy at all since it was on Chinese)
You will need to setup payment information (please use a virtual credit card and cancel it after it, to be sure the hacker can't get any useful of it)
I entered all fake info (street address, postal code, city)...
I was able it to change the region to my country of origin
After that I logged out and logged in again and when I was asked to activate the 2f authentication I entered my phone number and managed to get access to the account again.
I went to privacy.apple.com and submitted the account for permanent delection.
I'm sorry for my English, hope this can help someonelse
