Thank you all.
I've now changed the addresses like you suggested.

So if I got it right, the lesson to take is, if anyone ever has access to a wallet backup, it's unsafe forever.