Apple ID compromised

Apple mentiones some signs in this related article, and also explains steps to gain control again:

...

Your Apple ID might be compromised if you receive an account

notification from Apple for a change you didn't make, or if you notice

account details or changes you don’t recognize. For example:

• You receive an email or notification that your Apple ID was used to
• sign in to a device you don't recognize or did not sign in to
• recently (for example, "Your Apple ID was used to sign in to iCloud on a
• Windows PC").
• You receive a confirmation email from Apple that your Apple ID
• password was changed or your account information was updated, but you
• don’t remember making any changes.
• Your device was locked or placed in Lost Mode by someone other than you.
• You see messages you didn't send, or items you didn’t delete.
• You see charges or notices for purchases that you didn't make. Learn what to do if you see an unfamiliar iTunes Store or App Store charge on your credit or debit card statement.
• Your password no longer works, or it might have been changed or locked.
• You don't recognize some or all of your account details.

If you received an email, text message, or phone call that you're not

sure is valid or you think might be phishing, here are some tips to help determine its legitimacy.

...

copied from: If you think your Apple ID has been compromised - Apple Support