Account Hacked

I got an email saying someone in a different state logged into my X account, within a minute it said I had set up two factor authentication. I went to the X app and changed my password. But now when I try to log in, it asks for a code or to use a code generator.

X support replies back every time saying there is nothing they can do as I still have access to my account (which I do not) i suspect this is an automated response.

I don't understand how they gained access first try. I don't understand how I can still change the password.

Does anyone know how to block the hacker? I made another X account and reported the first account as spam. I don't know what to do. Thanks.