The stories I've seen where someone's account was hacked, it was much harder to regain control. Your story sounds like just plain bad process for changing credentials. ie: Typical helpdesk type call for "How do I update my password across multiple devices?"

I've got a few accounts that occasionally get several hundred bounce messages in a day for emails that didn't go out from my system. They're just using my address in the "From" line because it's a known-good address. Properly configured mail servers on the receiving end reject it (or at least I think they do) because the reverse lookup fails. [handwave] dkim entries [/handwave]