I'm hoping OP will consider editing his post within the next few days with the full story of what happened. I'm not going to share what happened without permission but once he explains you will understand why I've chosen not to.
The current theory is that a thief must have compromised my account by brute-forcing my weak password.
I don't understand why Stunna chose not to share that. It sounds like you don't really know what happened yet if that's all you've come up with. Is there more to the full story that hasn't been shared here yet?
Did the server log show a bunch of failed login attempts as the attacker tried to guess the weak password? If he brute-forced it, you would expect that to be the case.