What might have happened was whoever had login credentials on their own console were able to take precedence in changing the password for certain username accounts before the actual user themselves. So for instance, I have my account shared at home and with a friend who I exchange some content with, so if he (or some stranger) used his account first, he would have probably been able to reset my account's password before me. I'm sure some hackers might have had login info and decided to do this under certain e-mail addresses (but you should get a confirmation anyway, so it shouldn't matter too much).
EDIT: Nevermind, confirmation e-mails don't show the password you changed to. Maybe this is the problem.

:

Comment