Speaking as someone who just fell victim to the "hacking", i use the term loosely, the best solution is to use the security token / app hands down. I got lucky, they got 50k and my shards nothing worth even going through the recovery process. As far as i know i have not been on any sketchy sites recently and all scans come up clean, so im not sure what happened tbh. What i do know is i was kinda dumb for not using the key right off the bat.

That being said the spam in city chat could much more easily be solved ... or at least band-aided ... by instituting a broad anti - spam measure. Call it 3 messages in a row (within x seconds) earns you 60 seconds blocked from the channel. If that happens X times in an hour temp ban the account and flag for review. Is it possible some innocents could get caught in that? I guess ... But tbh if you're spamming mutliple lines of chat for any reason other than RMT you're probably annoying people anyway.