You have not mentioned which method they used in order to hack your father's email account.
See link how hackers gain access to a person's email account. In most instances it is through the email account user either having a poor password or by clicking on links contained within a scammers email or by the account holder giving the details of their email account and password to the scammer either by the scammer speaking to them by phone or by the users giving the details via a fake email offer etc.
See links.
https://cyberexperts.com/how-does-email-get-hacked/
https://www.kaspersky.com/resource-center/threats/hackers-and-email-addresses
Now that his contacts have received spam purporting to be from his email account, the spammers will continue to send them emails purporting to be from his account.
Changing his email account password does not stop this as the spammers are not sending them from his account, they will be spoofing his email address in order to appear that the emails are coming from that rather than using their own computer generated address.
You can not un-steal your father's contact list so I would suggest that he no longer uses the hacked account and gets a new email account and informs all his contacts that he is no longer using the hacked email address and any emails that come from that should be treated as spam and deleted without opening them.
As regards the 2FA phone number being changed you can reset and change that your self and you can also change the password for your MyBT and email account your self. It does not need to done by BT Customer Services.
To change the 2FA you log onto your MyBT then go to Your Details > Personal Details and scroll down the page until you find the 2FA section. Click edit and change the number to what you want.
While on that page you should also change your BTID password and confirm that the Contact Details are still correct.
You should also check that no forwarding details have been set up in your email account.
See link for further information and things that you should check and change.
https://www.bt.com/help/email/email-security/how-can-i-tell-if-my-email-account-is-no-longer-secure
The first thing to check is that there is no forwarding set up then change your 2FA then change your email password.
As regards BT security picking up spammers emails. There are on average 150 Billion spam emails sent world wide on a daily basis. BT along with every email service provider do what they can to stop those spam emails and they do in most circumstances but given the volume and the fact that the scammers are constantly changing and working on way to get around the spam filters some will invariably get through.
