i think Jim is suggesting it could still be a keylogger on your PC that is passing the old password (and potentially now the new password) to someone else. It wouldn't matter if you used a mail client or a web client for that.