@MojangSupport got an email yesterday (only saw it today) saying my password changed on my mojang account, which I haven't signed into in a while. So I think my account is compromised. I've updated my password but is there anything else I should do/check