Basic rules: Have a strong password. Don’t reuse that password on other sites because it’s more likely one of those sites will get hacked than your account will get hacked. For sites that support it, enable 2FA/MFA codes or email verification. Keep your email accounts locked down like Fort Knox, since Email can be used to password reset just about anything you have, usually with little difficulty.

That said, if the accounts had no activity for 2 years, they were probably created intentionally for the purpose of spamming/selling. They may have been saving them to see if the value goes up. They might have just recently been sold to a spammer and activated in their spambots.