So as someone else said, when you try to log in from another location, it locks the account until you go through the reset password step.

This means they have your email password to, and potentially have access to way more then that. Change all of your passwords, and do it fast. It doesn't take much for something like this to snowball into identity theft.