Sounds like cookie theft. Unfortunately there's no practical way for sites to bind a device identifier cookie to a specific device, so your actual machine and a

Sounds like cookie theft. Unfortunately there's no practical way for sites to bind a device identifier cookie to a specific device, so your actual machine and a different machine to which your cookie jar has been exfiltrated to can't be reliably distinguished. As for how your cookies were stolen, the best bets are either malware or a dodgy browser extension. That's also how they had your password. If you changed the password from the infected machine rather than a different one, there's a good chance the attacker has the new one as well.