The exact same thing happened to me with a spam email that somehow knew my password, which scared me straight. I switched everything to a password manager that generates unique ones for each site, and honestly it took a weekend to set up but I’ve never looked back. Now the only password I actually remember is the one for the manager itself, and that’s a huge relief.