I had my account on HitBTC "hacked" today. I received a password reset e-mail, which I deleted. Then a little later I got an e-mail about successful login by an attacker. I use unique passwords on all sites, and since password was reset anyway they didn't know it. However there has been no logins to my e-mail, so how did they get the reset link?

While I usually enable 2fa I did not have it enabled on HitBTC as I've never used them before (always considered it to be shady or scam). Yesterday I had to use them to dump my bgold. I withdrew my funds yesterday, but I suspect this may have been an inside job. The pieces just doesn't fit. Perhaps insider is looking for high value accounts to drain, but in my case he was a little too late.

IPs used by attacker:
64.237.40.140    Matawan, United States (used to reset link and login)
5.101.221.91 Nicosia, Cyprus (20 mins before attack a failed login)