My Twitter was hacked
jerseyfonseca.com
jerseyfonseca.com
Not setting up the account with sufficient recovery options is responsible only for your inability to recover it, not for the hijack itself.
Perhaps you should change your strategy? Personally, I use myname+website@gmail.com as then I'll know the source, when I find my email address has been sold to a 3rf party
I use one of my domain name with a catchall address at my email provider. Everytime I have to signup on a website or IRL with an email address, I just use "website-url@mydomain.com" or "company@mydomain.com". I maintain a simple blacklist of all the throw away emails that have been abused over the past 25 years. I have set up a rule on the email server to delete all messages addressed to any of these blacklisted addresses. This is very effective at cutting down spam.
Downside : when you get a real human from a real company on the phone or IRL. Usually, they don't understand why you have "their-company@a-domain-they-dont-know.com". But it was never a major issue for me.
Why would anyone keep "+website" after obtaining your address for illicit purposes?