Thanks, John - in fact what appeared on my account was an invoice, so that suggests that what the offenders have is my email address (which is fairly easy to acquire).   The money didn't go out of my account.
I will, however, take your advice and change passwords (again).

Anne