I'm sorry that you're having to go through this. Good luck sorting out your account access.

I actually got hit by something that sounds very similar back in July. I was saved by my DNS settings where "npNjs dot com" wound up on a blocklist. I might be paranoid, but it felt targeted and was of a higher level of believability than I'd seen before.

I also more recently received another email asking for an academic interview about "understanding why popular packages wouldn't have been published in a while" that felt like elicitation or an attempt to get publishing access.

Sadly both of the original emails are now deleted so I don't have the exact details anymore, but stay safe out there everyone.