You've probably just solved a mystery with my Minecraft account. A good while ago it got "hacked" while having a strong password (random and unique), plus all security answers were filled with gibberish, which I diligently kept backed up somewhere. At that time I also hadn't logged in for over 2 or more years. Eventually I got it back through a proof of purchase process, but I couldn't ever figure out why it was taken over. Since no other account got compromised, I could reasonably assume my computer wasn't either.

So I guess in the end their recovery process was susceptible to some good old-fashioned social engineering.