I changed the password to all my accounts (the ones still in use, and all the remotely important/“meaningful” security-wise) before they somehow got access to this one. I just got to see them bounce off a few others, which is how I guessed they were in Brazil, from the related security mails infos.

I used a different, secure password for every account this time. Idk what I could have done better and it seems to have worked for all my other accounts so far.