Usually because the same username and password has been used across multiple sites.
Also, although this doesn't appear to be the case for you, a lot of the posts related to 'hacked' VM accounts turn out to be cases where former customers have continued to use email addresses that should be closed down after they cease to be customers but have continued beyond 90 days before finally getting shut down.
________________________________
GrahamI'm a Very Insightful Person, I'm here to share knowledge, I don't work for Virgin Media, I'm a VM customer. There are no guarantees that my advice will work. Learn more
Have I helped? Click Mark as Helpful Answer or use Kudos to say thanks