There are some short-sighted counter-tactics showing up in this thread. "Do 2FA!" "Detect activity in JS!" "Scan new listings for copied images!" Sure, do those things. However, expect that after you fix the vulnerabilities currently being exploited, the bad guys will find others. They have every incentive to do so.

It's refreshing to see a comment that addresses some of the roots of the problem. Rather than only focusing on plugging holes in the dam, spend some effort finding ways to let off the pressure at the source.