Or you downloaded an app with a virus that gave someone else access to your accounts. Or you clicked on a link in an email giving the phone a virus. Or you went to a website that gave the phone a virus.
Or a "friend" got one of your passwords (or the only one that you use for everything - very unsafe) and now has access to all your accounts.
Or you installed a "cleaner" app - they basically collect all your information, including passwords, and send them to the developer's site (usually in China) - companies like Cheetah Mobile do that. (And cleaner apps don't really clean anything. Android removes apps that need to be removed, without needing any app.)