do you run a full node? I think If your wallet was encrypted then they sent it via rpc calls.