Q: iPhone showed a Map of a device trying to login to iCloud. I said "Don't Allow." How did they still get into my iCloud account that moment?

A notification on my iPhone showed a map of a device trying to login to my iCloud in Tampa, FL (never been there). I said "Don't Allow." Within 30min I see Emails of all my devices in Lost mode and an email of a new device who logged in using a Windows Computer from Tampa, FL. How did anyone get access if I said don't allow?

Other weird thing, I was recently researching a vacation in Tampa, FL but never gave out my iCloud email address but I did use my credit card at a resort and used a different email address (that is unassociated). My iCloud password is unassociated with the other email address nor any association with the credit card.