I also got my account back after having my password phished (stupid me). Fortunately, the phisher changed all of the info EXCEPT for my zip code....which was a flag for the customer service rep I spoke with on the phone.

Be VERY polite to the CSR on the phone...they have the power to give you your account back, but they won't unless you can somehow prove that it belonged to you in the first place. The CSR implied that if the hacker had changed my zip code, I would have been SOL. He also said that my account was established before a "secret question" was required. He suggested that I create a secret question so I could easily restore my acct if it was stolen again. I still haven't figured out where to do that - can anyone help on this?