It’s very likely not EAC that’s the problem. Best guess is the hacker has some kind of server side access, be it allowing unsigned/unauthorized operations to be executed from a client or having access to the servers themselves via rce