Credential stuffing account takeover wave

Support tickets spike: 60+ users in 2 hours report email-change confirmations and password resets they didn't request. Your auth dashboard shows login success rate dropped (lots of failures) but a steady stream of successes from a datacenter ASN, all hitting /login then immediately POST /account/change-email. Failed-login volume is 50x baseline. A third-party 'have I been pwned' style list for a competitor leaked last week. No MFA is enforced for most accounts. How do you triage and contain this account-takeover wave?