My account was created in 2013 and changed the password last in 2016. I went back and looked in the audit log for the last year and there was nothing else suspect. Just some failed logins, but that's pretty common, I didn't see any logged in usage from any IPs but mine
Could you please confirm which ip address the attacker tried to login from?
Also, how old was your account?