If an unknown user has a persistent logon, as you do have on the Now app on a TV, then any subsequent change by you, of password or whatever, won’t affect them.
But you can force a logout on all devices, which will get them off, via the steps below.
Go to this page:-
Change your password via the link there:-
This will stop the unknown use logging on again after you force logout, as below.
Set up a Payment PIN according to the link to that.
Not essential, but wise, if someone else has your account details, and you don’t quite know how, and you fear a further breach might be possible.
Finally, expand ‘How do I sign out of all devices’ and proceed as shown.
This will force the unknown user off, and not knowing your new password, they won’t be able to get back on. But note it will unavoidably force all your devices off as well, so you will need to log those back on.
Set a Payment PIN on your account so that no-one but you can buy memberships on it. Check your bank accounts monthly for any other unexpected payments to Now. That way you can at least nip them in the bud, while you and Now figure out whose fault they are.