His computer was apparently compromised with malware, because his email address and passwords have shown up in four separate stealer log datasets, all of them published since late 2023. If you follow these steps, it doesn't matter so much if your data is included in a breach because 1) your password is strong, so it should be difficult or impossible to crack, 2) even if your password is recovered, you don't reuse it anywhere else, and 3) if anyone tries logging in as you, they won't be able to because of 2FA. The data contained 22GB of logs consisting of email addresses, passwords and the websites they were used on, all obtained by malware running on infected machines.