Considering the desirability of a two letter account name, it seems likely this was a social engineering attack on Instagram support staff. Sadly, humans are often the weakest link.
Hope you manage to get your account back with all the photos intact.