You should definitely start changing your passwords though, because the wallet changes were confirmed via email, meaning the person has/had access to your email.  The wallet was not locked.