I know he changed them all. this is what the eform is for
you tell them what the information were and the last time you were in control of the email
they check at that date what the information were, and they check your ip address to confirm that indeed it was yours
if the hacker did not change the secret question, you would not be filling this form in the first place
edit:in my friend's case, her email was stolen, her contacts were deleted, secret question was gone, and it wasn't until a week later that we knew this form existed, and it still worked