... I think anyone with common sense would look at your background of damn solid reviews for several years and come to the conclusion that the 1/1 rating on the most recent review is bullshit. It was even questioned by the bad review author if you were hacked.
That said, before I get into it, I consider you a victim that has been harmed. I'm not going to point any finger at you but rather use this situation to explain a point that seems to perpetually fall on deaf ears regarding specific PII being passed around by those involved for the most part, in unlawful activities. From the (majority of) hobbyist pov, the fear of LE is minor compared with the fear of being outed and the personal carnage (employment/marriage etc) that could follow. It is the infinite, contingent liability that will never go away, but rather increase each and every time PII is shared with a provider thru email, social media et al.
I've looked at your ad(s) and have not seen any "screening" requirements so this may not be applicable, however, it would be assumed that whoever hacked your ad(s) either attempted to hack (or did) your email account. Something tipped off Proton and I doubt it was from them monitoring your ad or reviews. If it was hacked, even for a few short moments it should be expected that all of the information contained in your email folders was accessed/acquired by the bad actor.
It would be reasonable to believe that all of the contacts in your email are now potential targets and any info that they had shared with you was captured in the first actions of the hacker. The real question is how long did it take them to retrieve the information that had been deleted and how deep did they get before Proton locked the account? All of the information exists, whether it was "deleted" or not even though we are constantly reminded that any reputable provider of course deletes all PII after the screening process has been completed.
I get a tremendous amount of pushback from ladies who claim the ethical highground regarding screening but I have yet seen a single answer to my question of "Beyond the delete button, what actions do you take to eliminate all PII from your devices and storage?"
Anyone that has anything to hide should consider giving out PII to be nothing less than career/relationship russian roulette. It's not if, but when. The more you share you PII, the sooner you will find out how fucked you can become. The scenario the OP shared above is a classic case of a 3rd party inserting themselves into opportunity. The only difference between a hacker and an extortionist is the amount of useful information they can harvest.
In the days before internet, I became a part of what could have been a bad situation but that was from a bad player with LE connections getting my license plate at an incall I found in a MPLS adult weekly paper. At the time, I had little to lose and the involved were local and not overly sophisticated. It was a simple scam that was very poorly ran. I did, however, learn valuable lessons from it.
I hope you can quickly move on from this issue and I hope there was no useful PII of previous, current of future clientele in your email. I sincerely wish you the best.
