They definitely didn't get my mnemonic- the only place I had that was written on paper. Same as my wallet identifier and my password. The only thing I can imagine is that it was the Tor exit node as mentioned. I don't understand how that works but apparently it is a serious threat.
I am reaching the point of acceptance slowly. It is what it is. Hopefully others will see this and stay away from Tor when using the wallet, and also use 2FA. But probably the best idea is offline storage.