It doesn't really matter that much. The value of hacking your account is accessing the stuff that is in the account. Changing passwords should be less interesti

It doesn't really matter that much. The value of hacking your account is accessing the stuff that is in the account. Changing passwords should be less interesting. If they have a trojan on your computer, they can still access everything in your account. 2-factor auth doesn't help. Very little does help if you have a trojan on your computer. I admit in the scenario played out here - hacker tries to scam your friends - changing the password might help the hackers a little bit. Presumably they want to mail back and forth with your friends (first a plea for help, then sending a bank account number). Still, that is only a minor danger compared to major damage of accessing your account, which the trojan does anyway. For example even without a password the scammers could just claim that they have a new email address.