But that private key requires a password or keyphrase to use it and I'm having trouble understanding how this could have been compromised?
Phishing scams? Keyloggers? Access to your info? I'm no security crypto genius sorry, I'm not sure exactly how but when it comes to cryptos, anything is possible.
Best thing is to never leave all your tokens/coins in exchanges. Try to diversify them with different storing options (best ones currently are hardware wallets - trezors, ledger nano s), etc.