R6 account hacked by Xbox user “ooohazzz” – played placements + bought Battle Pass?? Need advice

Hey everyone,

I’m hoping someone here has experienced something similar or can point me in the right direction.

My was somehow accessed by an Xbox user with the gamertag “ooohazzz.” I don’t play on Xbox at all, so this immediately raised red flags.

Here’s what happened:

• The Xbox account was linked to my Ubisoft account without me knowing.
• They played 9 placement matches on my account.
• They somehow bought the Battle Pass, but I have no purchase history showing on my account (don't even have any banking card associated).
• Even after I changed my password, they were STILL able to access and play.
• I’ve now unlinked the Xbox account from my Ubisoft account.

What confuses me:

• How could they still access my account after a password change?
• How was a Battle Pass purchased without it appearing in my purchase history?
• Does linking an Xbox account give them persistent access even after password changes?

What I’ve already done:

• Changed my Ubisoft password.
• Unlinked the Xbox account.
• Checked email security.
• Enabled 2FA.

Is this possibly:

• A session/token issue where they were already logged in?
• Some kind of Ubisoft linking exploit?
• A compromised email situation?
• Something related to cross-progression?

What else can I do to properly secure my account beyond the obvious (password + 2FA)?
Should I contact Ubisoft Support to roll back the games or investigate the purchased?

Any insight would be appreciated. I’m honestly a bit stressed about it.

Thanks.

PS: I've recently bought the Elite Edition for PS5 but didn't found anything related to the Battle Pass.