Changing a password wouldn’t do anything. The account is locked due to failed login attempts, meaning that it doesn’t matter what the password is. X failed login attempts by anyone trying to login to your account will soft ban you for two hours. Similarly, it even happens with 2FA because it apparently doesn’t stop someone from trying to login without that.
Well that’s unexpected. I wonder if it’s possible that they only lock down portions of the account?
Did you also get a similar message saying that your account has been locked? There are multiple ways of buying V-Bucks, so it’s possible some areas of your account were locked, but not others. If not, it’s more likely that you used the same password in more than one place and that the password used elsewhere was compromised. If so, my suggestion is to change that password ASAP and enable 2FA. While you are at it, change the password to your email as a precaution. Since you did not authorize the purchase, and since Epic won’t respond, I suggest filing a dispute with your credit card company over the fraudulent charge and DO NOT USE the V-Bucks at all. When filing the dispute, be sure to notate that you tried to contact Epic about the issue and were unsuccessful. Notate as well that the purchased item is still unused on your account and are willing to have that reversed on your account. Otherwise, if you use it and also try to dispute it that will probably get you into trouble.
For reference, here are the contact options available: