so on my discord getting hacked a couple days ago, figured out yesterday it was via my email password having been in a breach. i didn't think of that at first, they might've gotten away with it had they not slipped up - i got an email from booking.com (a site i have never used) in russian. once translated, it basically said that "my" account was being suspended because something didn't look right on their end. they'd already deleted the booking.com account by the time i got the email, but hadn't deleted the email to avoid me seeing it yet.
anyway, turns out my email was using an old password that i had used a lot of other places, and forgotten to change when moving from it to unique passwords.