You have to deactivate your account if you regain access for a few days and nuke everything associated with it. Update with new contact details and possibly a new phone number you have stored away for online accounts that require it (No SMS 2FA obviously if it can be avoided) Haven’t heard of a yubikey being compromised. That’s the last thing I would swap out if the above steps won’t work.