> Okay, which site was this?
The site it said it was?
> Is there a password I'm supposed to change?
Do you have a password saved or memorized? Does the site have a link or form to log in?
> Was it actually a password I stopped using 5 years ago, but is still floating out there somewhere?
They can't be sure. Why not change it to be safe?