someone close to you just needs to know your password, which was likely used everywhere or was very weak. They probably already had your email or phone number.