I had the same password for over 15 years before my yahoo account was hacked. A friend sent me an email because he knew the type of porn he was getting from me wasn't from me. I report this to yahoo and they told me to change my password. And I know how it happened. I had never used email on my phone before until the last phone I had. I usually sent pictures I took with my phone to my G-mail account and then forward to my yahoo account. I added my yahoo account to my phone. Unbeknownst to me, on my phone it never signed out. That is how I was hacked, through my phone.
Yahoo traced the hack through a bunch of IP addies all the way to Japan and the trail stopped. I was livid. Got over it eventually. I have a new phone now, but I only use my G-mail account and never added my outlook or yahoo accounts to my phone. And frankly, unless a company I work for gives me a phone for work, I won't add other email accounts.