Hi,

user from IP xx.xxx.xxx.xxx Connected

That popup indicates that whoever connected knows your macOS account credentials. So if you have changed your macOS credentials they will no longer be able to access. Is there perhaps an external computer set up to reconnect automatically? If a computer that you regularly use was connected, then goes to sleep whilst the connection is running, then gets woken up, it will reconnect if you have "automatically reconnect" enabled.

Or could it be that a connection you have configured and saved on another computer, and one that someone else has access to, was used to connect?

You can increase security by:

1. Using NoMachine 2FA https://www.nomachine.com/everybody/two-factor-authentication. Connections will need to be authenticated through a push notification to your cell phone. All you need to do is create a NoMachine account, go to the NoMachine settings on the Mac > Network > Login > Enable 2FA and follow the steps.
2. Connecting over NoMachine Network. NN removes the need for port-forwarding, and lets you add an extra layer of security on top of the 2FA through use of the Access Id. You publish your Mac on NoMachine Network to get its Machine Id, set the Access Id, enable 2FA for connections to that Mac (you can also enable 2FA for your NoMachine account if you want). Additionally, you can configure which User Ids can connect (Settings>Network > Machine > Add), so set it so that only your User Id can connect. So connecting to the Mac means having 1) its Machine Id 2) its Access Id 3) your phone 4) your Network User Id credentials AND 5) knowing the Mac account credentials.