Nope,nothing you can do but wait.
Or you could click on a blue and see if they could fix it faster.

That sounds like your account got hijacked.
Support will only get back to you on business days, but you can PM a staff member, such as JudasIscariot.

You can't login, but you post from account registered in 2009? :/
Have you used "abcdef" as a password for your primary account?
Have you logged in via public wifi with weak protection?
Pirated any games, run a backdoor-infested binary and got keylogged (are keylogged right now as well)?

Nothing should happen to your account, because one can't remove the games from it, so keep persuasive contacting the blues until your account gets restored then give a thought about questions above so it does not happen in the future.

What you can ELSE do, is to contact ABUSE service of the said Russian account, then write them in clear English that this email is used by a CRIMINAL and provide PROOF to them, which includes that email from GOG, INCLUDING RFC email headers as well as response from Blue (confirmation). Mention, that its possible that this Russian email might also STOLEN and MISUSED from valid owner. Insist that ACTIVITY done from this account is CRIMINAL and PROVE it.

If you stay polite and rational, they can BAN the email of the CRIMINAL even without court decision or LOCK it - that criminal will have to contact them personally. There is a chance that you will do more damage to him, if the uses that email for other criminal activity as well.

How are people getting their accounts hijacked? What sites are you going to? Do you even password?

I'll eat my words if it happens to me, but it seems like this happens a fair amount to people, and I don't get it.

You have minions? :-o Cool!!

Pics or it didn't happen.

Yeah, but those little yellow guys seem to bugger things up pretty good.

Maybe this Russian decided to buy some games for you. There is a bright side after all... :D

I thought Oompa Loompas did all the labor at GOG.

Could you please implement two-step authentication for account-critical stuff (e.g. changing of the mail adress) only? Many of us clear the cookies at the end of each browser session and don't want to be bothered every time we log into our account. We would still be happy if we get informed when somebody tries to change our mail adress. Informing us afterwards (the way it works now) is useless.

+1. Actually, +1000.

I use quite few computers and other computing devices, multiple browsers, from multiple different locations with different IP addresses... And for security reasons, I'm not going to make it so easy for all my devices to access my email. So there'll be times I won't be able to log in with the current 2fa scheme. It's not good.

Please, just allow us to limit 2fa to password & email changes.

Having the summer sale straight after introducing Connect - I can imagine you guys must be swamped