Kula
First let me say how sorry I am this happened to you.
I was scammed with a fake login page early on in my Neo experience

The scammers took ALL my np, moved alot of things from my gallery/shop and sdb into my inventory but didn't take anything but the np. At that point my pets weren't painted, I was saving for that - so the scammers got about 100k. They didn't change the password or the email which even I think is odd. The moving things around I think was just to "play" with me.
Now my situation was somewhat different than yours, but I agree with Morningstar on this one. Someone knew the password -- either the original scammer, the original owner, or did you maybe use a public computer? I've heard that more times than not, that that's how someone gained access, through a shared (at home or public) computer.
In your case, I would definitely change the password, changing the email is tricky now -- they send a request notice to the OLD email, so anyone with access to that has access to any other information.
Technically, it is against the rules to give an account away. Maybe that's partly why they send an email to the old email addy. I don't know.
Untill you talk to the person who had the account and get things straight with them (that you're changing the email, that a confirming email should be coming to them authorizing the change, etc.), you may be open to repeated instances of someone else getting into and doing whatever in that account.
If the original owner was scammed and the email was changed so that they don't have access to it, I don't know if there's really anything you can do. That person should have notified TNT when the account was originally taken over so that the email and all other information was correct.
So, see if you can get in touch with the original owner, find out exactly what, if anything, they did, if the email is under their name and if so, that they will help you in changing it to the new email so you can change all the information with confidence.