The hacker was smart, yet, my YouTube nor PayPal have been accessed despite having the same password. Nor did my other 4 accounts get hacked, which unluckily don't have much value in their bank. Also the same password. This helps me believe even further that my password was never actually retrieved.
Uhhh... Alright.
Also, hate to tell you dude, but you didn't have an auth set to your account. If it wasn't prompting you every time (Or every 30 days, if you hit the checkbox), it wasn't on there as is.
The best security in the world can't protect people if they don't use it.