How to report my stolen iPhone and secure my Apple Pay account?

I guess what we know for sure is that this person did have access to your phone number, email address or other contact information. For certain the individual is not able to effectively use your stolen iPhone effectively due to it’s being tied to your Apple ID. This person has also made it clear that they wish to frighten you into doing what they requested. I think the first thing I would try is follow the lost phone process again and try erasing all content remotely. No matter what, I would not do what they are asking!

Any Apple devices you have associated with one Apple ID will be listed separately in your account. You can report the specific device that was lost or stolen and remotely erase ONLY that device.

No, if you follow the Apple process for a stolen or lost iPhone it will delete your data but will not free up the phone for use. The important thing is protecting your data. We really have no way of knowing over all this time what the condition of the iPhone actually is. On your new iPhone on the current iOS release you can now select extra protections keeping anyone else from accessing your iPhone data.