Hey there,
Sorry to hear this has happened - hopefully we can get your account properly secured for you now you're back on the account.
Without access to your account, I can't say for sure how the hijackers gained access, but if a hijacker has accessed your account, then the hijack could only be for one of the following reasons:
- They have significant information about your account which allowed them to recover it and register their own email - upgrading to a Jagex Account will remove the ability to recover your account through the legacy recovery system
- They have access to your email
- You've unwillingly provided your login info + authenticator TOTP (phishing/keylogging by the hijacker)
- You've willingly provided your login info to someone
- You've been hijacked in the past, the hijacker linked a third party account to your RuneScape character (like Google, Apple, Steam, Facebook etc) and used this link to access ...