If there are security questions on the account then the account must have been set up many years ago. Several years ago Apple transitioned to using two factor authentication instead of security questions. You can continue to use security questions if you already use them and they are working for you, but if you have problems then they no longer get direct support. You can try the directions in this support article If you forgot the answers to your Apple ID security questions - Apple Support but the article is labeled "archived" and may contain information that is out of date. If the instructions work then fine; if they do not (e.g., “not enough information”*) then you will have to change to the newer security method if you can. Over the past few years Apple has been persistently encouraging users to switch to the newer two factor authentication security system. For those who have disregarded their encouraging, Apple will likely only help you to now change to two factor authentication, if even that is possible. Follow the instructions in the "Turn on two-factor authentication for your Apple ID" section in this support article --> Two-factor authentication for Apple Account - Apple Support to try to change to two factor authentication.
If you still need help, contact Apple ID support at this link ➞ https://getsupport.apple.com/?caller=cups&PGF=PGF63005
Select "Other Apple ID Topics", then "Security concerns or account compromised." This will give you a chat or telephone call option.
If Apple can not or will not help you transition to two factor authentication then it is quite possible you will have to simply abandon the old account and everything it contained.
If a hacker created the Apple Account, does it really make any difference to you? It doesn't really affect you in any way other than you not being able to use the email address associated with it as an Apple ID for your own account.
Good luck!
*See the third page of this discussion Unable to Reset Apple ID Security Questio… - Apple Community Some people talk about getting out of a “loop” by logging in a different way. I am not really following what they are talking about but maybe you can see if it helps.
