Change your password now. The old message might be fishing. Use the normal way to change your password form the setting. Not only that, but also, change your email address password. The attacker might have the ability to log into it. YOU MIGHT ALSO HAVE TO CHECK THE LOGED IN IP ADDED AND LOCATIONS YOUR ACCOUNT HAVE LOGED FROM. IF YOU SEE ANYTHING SUSPICION REPORT YOUR ACCOUNT STRAIGHT AWAY AND Deactivate your account.. good luck.