If you made the account a supercell account and put a different email account with it, as I know is possible, no other player can access it from that point unless you give them access. It seems this is what you have done. Is that correct?
Is it also correct that you have not given anyone the ability to use your account , even on a temporary basis, as is possible with a supercell account. They donโt need your details or email password to gain access with that type account, it seems. All they need is a device and a phone call or text with the passcodeโฆ.. once they input the new email.
You say you have not done this since you learned more about FWA rules? FWA does not specify all the ways we might mess this sort of thing up. We get to do that by hit or miss, by trial and error, as you discovered.
Please answer the question of whether you have sent anyone the six digit passcode for your account.