Signs: a New login detected email you do not recognise, security emails about changes you did not make, unknown sessions, orders or withdrawals.

Act in this order:

If you cannot stop the intruder right away, freeze the account: click It wasn't me in the email about the action you did not make (no login needed), or open Account → Security (Freeze account): orders are cancelled, withdrawals blocked, withdrawals not sent to the network yet are cancelled, everyone is logged out. How do I freeze my account?
Change your password in Account → Security. This logs everyone out and blocks withdrawals for 24 hours. If you cannot log in, reset the password.
Check two-factor authentication: if it is off, turn it on.
Check API keys in Account → API Keys and click Revoke for any key you did not create.
Check sub-accounts in Account → Sub-accounts. If only a sub-account is affected (for example, its API key leaked), you can freeze just that sub-account with Freeze.
Secure your email: change the email password and turn on two-factor authentication there. Whoever controls your email can receive our codes.
Write to us through the support form: what happened and when. Include IDs of suspicious withdrawals if there are any.

Withdrawals already sent to the blockchain cannot be reversed. A withdrawal that is still waiting to be sent is cancelled when you freeze the account, so freeze it first: act as soon as you notice. That is also why the 24-hour block after a password change matters.

Stay safe: Strade support never asks for your password, 2FA codes or seed phrase.

I think someone else has access to my account