Happened to me today. First got the message on my computer that my location was unknown and needed to enter a code from the phone. By the end of it, I had to reset my Apple password. No idea why it happened.
Happened to me last night. I got a push notification on my watch that I needed to update my iCloud password. I thought that this isn't right, so I went to my phone and MacBook. Same thing, those devices said I needed to change my password. So I figured someone has my @iCloud email address and tried to login. I do have hardware keys setup, so wasn't terribly worried. But none the less, I liked my old password and had…
So... anyone with just your iCloud email address can get you locked out?? That's not what I would call secure...