Along with changing your password, you should run a scan. I use the free version of Malwarebytes. Download and update then run this every week or so. I'd run a full scan the first time, a quick one after that.
You can tell often if an address is real or spoofed. Mouse over any links in the message and look at the bottom left of your browser screen - you'll see what the actual address is, despite what the code says in the message.