A password change you did not make can indicate account compromise, although other causes are possible.
Use the email provider's official recovery page or app. Do not follow a recovery link sent by the person who contacted you.
After regaining access, change the password, review active sessions, remove unfamiliar recovery methods, and enable multi-factor authentication.
Check other important accounts that use this email address for password-reset requests, unfamiliar sign-ins, or changed recovery details.