gmail hacked, password and recovery phone changed

Free Gmail has no human support, so the recovery form is the only door. If it says it can't verify you, try again a day or two later from the same device and network. A lot of people get through on the second or third try. While you wait, think about what else uses that address. Bank, Amazon, social accounts can all be reset through that inbox. Change those passwords now from a clean device, and move them to a different email if you can. Also give your contacts a heads up, hijacked Gmails get used to send 'I'm stuck abroad, send money' messages.

that security alert at your old backup address is your best shot. open it and use the link in it to say it wasn't you. google gives the previous recovery email a window to reverse changes like this, so do it today, not next week. if that doesn't work, go through google's account recovery form. do it from a device and wifi you've used that gmail on before, and when it asks for old passwords give the most recent one you remember. those two things matter more than anything else you type in. after you're back in: check the Security page for third party apps and devices you don't recognise, and look in gmail settings for forwarding rules and filters. that's where they hide stuff.