Yes, I have got this msg couple of times and changed it as well. Also there is now 2 way verification which I'm using now it's a lot more security that way.
How is that odd? He literally change the account email by resetting it via my own email. It's fine if you have no way to check if what I'm saying is true you can close this thread.