Buy one of these. It should be a good replacement for a lost Now Stick remote.
Do not buy a cheaper IR-only one, as they don’t work with the Stick.
The above remote is normally £19.99 from a bricks-and-mortar store, but both Curry’s and Argos have it at the same £14.99 as Amazon at the moment, if one of those is more convenient for you.
Set a Payment PIN on your account so that no-one but you can buy memberships on it. Check your bank accounts monthly for any other unexpected payments to Now. That way you can at least nip them in the bud, while you and Now figure out whose fault they are.