As if they'd ever tell anyone if they hacked your account? Why haven't you locked it if it's been a couple weeks already?
Last I heard, only the owner, to whom the payment info and other personal data refer to, can get an account locked unless it's proved of RMT activity.