Well lets assume for a second that it is instead a service that got compromised... unless you use a bad service that saves your password, they are using auth to

Well lets assume for a second that it is instead a service that got compromised... unless you use a bad service that saves your password, they are using auth tokens which may not necessarily stop working just because you change your password.