Did I get that unlucky and get assigned a bad IP?
Its mobile data btw.
And I don’t wanna point fingers and blame Proton, but like… c’mon,
First of all, its a real IP address,
Second, even if it were a VPN, so what, your company literally runs a VPN lol, kinda ironic.
And its also a paid account, and I rarely (almost never) send outgoing emails.
But again, this is just a small annoyance, I generated a new password in Keepass and its seems fixed.
You can check on https://haveibeenpwned.com/
It’s more likely to be that they found out your login credentials, yes.
They might find a site with crappy security where they can try many usernames and passwords without getting blocked or they might actually hack the site and get the password list.
Having a strong password, not reusing passwords and enabling MFA goes a long way towards protecting against those scenarios.