It's a problem but so far not the cause of getting hacked. Let's try to avoid another discussion about the NSA, USA and most other countries about email and in general communication intercepts.

That out of the way I have to advise not to track where the PHISHING EMAILS come from. It is best to do what you did with password changes and locking down and do not track that email since doing so can have you possibly opening up the bad email or going to shady web sites.

You did fine. Now you need to delete these emails and move on.