You may have accidentally used a client that captured login or authenticator details. There are dodgy variations of Runelite that appear on Google from time to time, for example.
I'd recommend adding a new authenticator to e-mail and your game account. Change the passwords, remove any linked accounts etc.
I can see you've appealed, so it'll be a matter of time before support take a look.