If the credentials are type on a computer, I would say the most likely scenario is the computer is compromised, a virus.

Make a backup, format the system and start from scratch.

I would recommend Ubuntu instead of Windows. Blocking all ports for incoming connections is very easy on Ubuntu with the ufw command. Not so easy on Windows.