I'm confused. This has a very simple, and likely explanation. Someone found their old password written down (or found an old hard drive). This is one of the most obvious and clear-cut applications of Occam's Razor - why jump to "state-actors"?