The hacker never changed the password, they just used my account to spam scam images, and I was able to change the password to get them out. I never clicked any suspicious links, this was most likely caused by my password being compromised and me not having 2FA enabled.