Short answer. If your Instagram was hacked and the email changed, search the old inbox for mail from security@mail.instagram.com and use secure my account. Then follow Instagram's hacked-account steps. If a disable notice appears, appeal it. Never send the password.
Instagram hacked email changed means the reset path was pointed at someone else. The old inbox is still your best tool if you can open it.
The secure my account link
Search the old inbox for mail from security@mail.instagram.com. Instagram’s help page says that when they tell you the email was changed, the secure my account link in that message can undo the change. Open it on a device you trust. Screenshot the mail first, including the time it arrived. Use the link while it still works. If it is expired, keep the message and continue with Instagram’s hacked-account help. Do not forward a login code to anyone who offers to click the link for you.
When the login says disabled or suspended, a new password is not the whole job. Screenshot the notice and appeal. Instagram account disabled: how to get it back is that button. Do not forward a login code to the person who “noticed” the hack.
Send the username, the old email, and any screenshot. We file the disable appeal through Meta’s own official channels. It takes a few days. Start a case on the contact page. How it works is the three steps. We never ask for your password.
Open the old inbox and find the message from security@mail.instagram.com. Instagram's help page says the secure-my-account link in that mail can undo the change.
The link is expired.
Keep the email as proof and continue with Instagram's hacked-account help on a device you have used before.
The account is also disabled.
Secure the email so replies can reach you, and screenshot the disable notice for the appeal.
Do you need the new email's password?
No. We never ask for any password. Send the username and the security email if you have it.