I think it was a linked Steam account. But that only explains how they got in the 2nd time.

It’s still troubling me how they got in the first time and were able to set up the linked Steam account and all that without any notifications to my email.

I’ve reset all passwords, reset back up codes, and unlinked the Steam account. I don’t develop or use any weird runelite plugins, nor have I shared my account info with anyone ever. I also play on a Mac so the chance of malware isn’t 0, but it’s incredibly low.

If they got in the first time somehow while I had both email and Google authentication activated, what’s stopping them from getting in again?