I seemed to have gotten a lot of account reset emails from around the web (EA, InstaGram, Others) and as it was a reset link emails followed by reset code emails followed by another email stating everything had been changed - that told me something was amiss. The ResetCodes were either brute forced (Not likely but possible) or a 3rd party was logged into my VM Email Addy.
I Take Security seriously and honestly the fact that it's 2023 and there's no 2FA options (that I can find) and the Password restrictions make Brute-Forcing the accounts Easy... It's just Plain NUTS..
I Phoned support and asked for all active sessions on my email account to be signed out - They are unable to do this!, I asked for my password to be changed to something and at first they refused to do this (The website wouldn't let me, but now I know it's because you have to log out, clear cookies, log back in to webmail like it's a new virgin media account - Nutty Butty design). And the fact that I can't view active security on my account means I can't find if the fault is with VM, Me (the user), or if it's a Brute-Force on those specific accounts in question. It's just nuts.