Q: iCloud accessed then lost mode activated - not by me!

Hello, this morning I received an email saying that my iCloud account had been accessed by someone on a Microsoft device, using a google browser, then 30 mins later my ipad lost mode had been activated and then it had been found. Needless to say this wasn't me.

Sounds very dodgy? I tried to change my password but I have forgotten my security qu so it's all a bit strained. Any advice? Has anyone experienced this before?