FYI everyone I figured out how they got access. It seems they were using a browser session key to gain access to my account. I don't know how they got the key, but it's revoked now.
If anyone knows how they got the session key please let me know so i can protect against it in the future.
