I had similar problem. The thief changed my particulars, password including trusted number. My Apple ID is still my Gmail. I received all the notification emails. And when I tried to log into Apple, I couldn't do a thing.
Then I contacted Apple support for several times and I even talked to them on phone for like one hour. I was able to answer all the questions like my credit card number I used, my emails, my particulars and even the recent trusted number I used for the account. But not the new trusted number the thief has updated. I was able to provide all the emails from Apple. But guess what, just because I don't know that new trusted number, they said they cannot help at all. That was so funny and I was shocked. I used to keep all my works on iCloud. I even use 50GB monthly subscription.
Now just because how Apple solely rely on just that number, I have lost all my works, photos and everything on it. Imagine that my iCloud account was used since like 2010 or something. I can't imagine how stupid Apple is to rely just on this one but not the iCloud email? They need to have a proper thinking.