User Seeks Advice After Phone Theft Compromises Email and Bank Accounts

The user’s phone was stolen with no security measures (no PIN or password), allowing unauthorized access to their open email accounts and bank account. After discovering the theft, they changed email passwords, enabled 2FA, terminated other sessions, got a new SIM card, and remotely locked the stolen phone. The recovery emails and phone number for the email accounts remain unchanged. The user is unsure if the attackers maintained access or if they should abandon the compromised emails.