Hacking question

[SKKY]

10. It was almost certainly from a previous compromise...

...and unfortunately there isn't much you can do about it in terms of not receiving these kinds of emails. There have been so many breaches, across so many platforms and services, it is almost impossible to imagine a scenario where at least some of your information isn't out there in the wild somewhere. But, all is not lost and it sounds like you're making good decisions as far as monitoring things. Change your passwords, all of them, and enforce two-factor authentication for all your accounts that offer it. Get credit monitoring through your bank. If your bank doesn't offer it, get a different bank.