Do you know, what exactly your father gave out to the scammers? If it was just his actual email address, that’s annoying and will almost certainly result in an uptick in spam email, in itself, it’s not the end of the world. If he also handed over his password for this email, that’s more concerning, and the very first thing you need to do is to take steps to change this password.
You mentioned ‘other ID’, without, naturally going into details, do you know what that was?
I don’t believe that VM can ‘change’ the email address, as they no longer support giving out new addresses for anyone. Your best bet is probably to spin up an entirely new email address for your father, from some other third party, Google or Microsoft for example. Once done it is possible to use this new address as the login tied to his VM account(s), then start the, laborious, process of notifying all of his contacts of this new address. Once done then simply forget about the old, compromised, address and just stop using it.
