I really need help with my hacked account please.

someone hacked into my account and sent emails to my friends. I completed a form to gain access of my account again, as they had changed the password to it.

I changed the password to my account but couldn't change the security info because the hacker tried changing security info day before.  So it now says "the old info will be removed in a month".

I cannot cancel the update on security info because the old info is my old phone number which I can not use.

So how do I stop the hacker from getting into my account meanwhile?

and does this mean he can still gain access to my account?

I am a little confused

please help, thank you