Best guess, I think it was actually more of a brute force kind of deal. I was lazy and saved my passwords in Chrome but didn't secure my email. Once they had that, they had the keys to the kingdom.