MEXC says a $340K account theft dispute is resolved after a user claimed an attacker-created API remained usable after account recovery.