For someone to get your info one of two things happened;
1. They used a keylogging program which isn't cheap
2. You have your password settings to "show" and they snooped around and saw your password.
But you said you've reset the password and 2 step authentication which doesn't make sense for #2. Something else is at play but I know you can only divulge so much info on here so I won't push. If it was a keylog program then you need to toss the phone to be 100% safe and the person you might suspect of doing is one way or another dealing with LEOs since they can buy in bulk for discounts.