There are two transactions before the ones where 1840 was taken out (for 902 and 977 XEM added to your account).  Those transactions took place around May time this year.

I'm assuming that was an exchange you brought from and added to your account?  Those same XEM have been sent to that same exchange address:

NBLQ6P-E7Z5CV-ANJNXG-OR74UQ-LOJ2YM-GJJOZ4-YFAQ

If someone has access to your account then they probably sent the amount to the exchange to sell.

Perhaps you could check with that exchange, explain your situation and ask who owns the account with the message ID: 5d19a020ad3211e7a6c717a42ec3df90

They would know the users details (assuming they have a verified account) KYC etc.