My tax preparer sent my taxes to the wrong email. Unsecured. How do I protect my identity?

My fiance and I have been using a local tax preparer for a few years. I had them email them to us to sign and email back to file as we had done previously with no issue. They sent both of our taxes in pdf form to my email and cc'd my fiance. Unfortunately, they missed two letters in my partner's email. The email is not encrypted or secured in anyway. Email verification sites give it a pass and the message I sent as a test did not get failed delivery message. I have no reason to believe that both her's and my taxes are not sitting in some randos inbox. I have the preparer on record admitting fault and apologizing, offering to file ours for free this year. I have not accept or denied anything yet.

What steps do I need to take to protect our identities?

What sort of cost should I expect on my end?

What extent of any cost is reasonable to expect the TP to cover?

Do I have legal recourse I should pursue either now or if either of our identities are stolen?