You laugh but the fact that you got a login confirmation notification means he got your password now. He’ll just need to guess your email password next and you’ll be truly owned. Set up 2fa on your email account if you haven’t set it up already.

If only you knew how many critical systems are running old versions of Windows… It’s mind boggling