Changing your password was the thing to do. And, see these read on security, especially the first two.
If you think your Apple ID has been compromised https://support.apple.com/en-us/HT204145
Security and your Apple ID https://support.apple.com/en-us/HT201303
iCloud security overview https://support.apple.com/en-us/HT202303
Ways to keep your information safe on Mac https://support.apple.com/en-gb/guide/mac-help/mh11402/mac
Using app-specific passwords https://support.apple.com/en-us/HT204397
UseTwo-factor authentication for Apple ID https://support.apple.com/en-us/HT204915
__________
And if you already are using two-factor authentication, you can Check your Apple ID device list (https://support.apple.com/en-us/HT205064) and remove any device that shouldn't be signed in using the steps in the link.
If there are none that shouldn’t be signed in, then you should not have a problem at this point. But, if an unauthorized device signed in, Change your Apple ID password https://support.apple.com/en-us/HT201355. I know you already have done this, but see:
What to do after you change your Apple ID or password https://support.apple.com/en-us/HT204071