yeah....
EA would even know or admit it, accounts details appear to slip out somehow. I had an account, set it up years ago, but never really used it. I had a few games on it, but never used them and didn't have origin installed.
Then after a couple of years get an email from origin, saying i have been warned for misconduct in one of my games, that I had never actually played, i emailed origin, got nothing back from them, so ignored it. Then about 6 months later got another email saying my password had been changed.
The i contacted EA by phone got them to reset my password, everything was now in Russian, and had a few more games, then I enabled 2 factor (phone authenticated).
My password was not a simple one, was random upper, lower, numerical and special and not used on other sites.