I applaud Judas and Cwaniak for their response time, especially since it's a big holiday.
But this is exactly the reason why confirmation should be required before any such changes are made final to an account. Informing the legal owner after the fact doesn't cut it.

I hope GOG will listen, and make the necessary changes.

Here's the thing. If a hacker wants to buy a game with a Russian discount to sell the account (FYI, the discount doesn't apply to gifts), they don't need to hack an existing account, especially a non-Russian one. They just need to make a regular Russian account and buy a game. It'd be a much better imitation of a real new Russian user. Same goes for stolen cards and such.

However: since hypothetical prospective profiteers buy games at Russian prices, they can't go lower than a Russian price, and their hypothetical customers can cut out the middleman and do the same. Making one's own Russian account is safer and cheaper than buying someone else's Austrian one and then pretending the [former] owner made a highly ill-advised life decision.

So it's not likely that accounts are hacked to conduct any semi-legitimate economic activity after hacking. More likely, they're just hacked for resale purposes. Now, you can ask why people are paying for stolen games they still have to download off the interwebs* when torrent trackers are right there. I don't have a good answer for that other than "people are stupid".

*There are places and societies where an internet connection outside of Facebook (not to mention software) is prohibitively expensive, and people buy, sell and trade pirate software packs for a fraction of the cost (or free).

Oh, ok.. This I didn't know or have missed somewhere so thanks for pointing out. :)

That sounds reasonable when talking about hackers even when pretty much everything can be found just by torrenting. Torrenting stuff doesn't doesn't give money but reselling account loaded with games means profit. Ok..
"People are stupid" is pretty good answer. X-)