> They didn't change their password, so it wasn't really stolen You change your password only after you realize it got stolen. If you didn't realize it, then i

> They didn't change their password, so it wasn't really stolen You change your password only after you realize it got stolen. If you didn't realize it, then it makes sense you didn't change it. And, depending on the specific case, you could find plausible explanations also for the other points.