The agent gave you great advice:
1. submit the form to cancel the representative to CIC. Include a letter to advising CIC that this person continues to access your information and changed your address again without your permission. Then request that all correspondence be sent to "put your full mailing address" and/or "put your email address" only from this point going forward.
I did it around a month ago,and i got an email from cic ,i was told the cancellation was effective
2. Go to myCIC and change your username, password, etc; set up a new security question and answer that the person does not know.
I did it ,too.But i just found that if there sb know my info also can log in,but the person also change my mailing address by email
3. Yes - there is a legal method which involves going to the police and speaking to a privacy lawyer. There are laws which govern how our personal information MUST be handled/stored and the consequences of breaking them could be jail time and/or hefty fines. It may take a lawyer sending this person a serious letter for them to stop. If you have already asked the person in writing(email or letter) to stop what they are doing, do not contact them again. Do not send them threats or you could be the one in trouble.
What kind of lawyer I could seek for help? Immigration ,criminal or civil?
4. Begin collecting evidence e.g. if you changed your address today, use "control + alt + print screen" and paste the screen shot on a Word document. Then if you check later and notice it has been changed, save it again, etc. This way you have documented proof with dates of when things happened.
I've never thought about that,appreciated !
Hope it works out well for you.