But that private key requires a password or keyphrase to use it and I'm having trouble understanding how this could have been compromised?
it already happened. I dont know how and what would be the main reason why your funds has been stolen, even if it requires a password or a keyphrase, the hacker must have fully control of your wallet, maybe you become victim of phising or someting, just be careful next time.