Ditto on the authentication.
I use the Proton Authenticator. In the past I used FreeOTP.
I am thinking about switching to a hardware key to log into my e-mail.
Now for the Nitty Gritty.
Who is your e-mail provider? is it gmail or someone else who uses Passkeys?
If it is, then it is quite possible that your credentials have been sent to attackers and they may have added a Passkey to your account for themselves. If that happened, you can change passwords all you like and it won't keep them out.
Change your passwords and check to make sure that the only passkeys are those that you have entered yourself. If necessary, delete them all and add new passkeys and use an authentication app such as Proton Authenticator or FreeOTP.
And don't click on links in the e-mail.
What I would ultimately suggest is to switch to Proton for your e-mail. You can set up a free account. If you like it, you can make it a paid account. You can get $20 off with a referral link such as mine at
https://pr.tn/ref/AZ0CPNEPFor passwords, don't use short passwords. Use something long. Longer is far better than a shorter complex passwords. Here are some suggestions of the types of passwords to use:
finger licking good silver plated polar bear
anhydrous zenzizenzizenzic toothpaste additive
