Root user cannot start LightSail instance after possible unauthorised access

My AWS root account was compromised at the start of Sep and I reset my password. I was getting a sitemap.xml that was pointing to random Chinese sites. I tried a few things and tried to restart of Lightsail Wordpress instance and it gave me a 403 unauthorised error. I tried stopping which was successful but Im unable to start the instance with my root user or my other iAM account which has full access to Lightsail. I saw a similar issue with someone else who required AWS to unlock something on their account.

My website is down so this is urgent. Ive lodged a support ticket too but it doesn't allow me to log a technical support request as Im on a basic account.