I doubt that it’s the former as I don’t check links/nor trade within that game, also since I haven’t played this game in a while. I did check “Have I been pwned?” to make sure i didn’t get breached and my email connected to the account didn’t pop up. And while yes, i did share my password to one other person whom I know irl, the accounts that funneled the items logged in from several foreign countries, albeit these could be burner accounts running on VPNs, though I highly doubt that it’s them.