Your friend shows you their email account's recent activity page. It shows login attempts from cities in three different countries — none of which your friend has ever visited — all within the last 48 hours. Their current password is 'soccer2015' and they use the same password on five other websites. As a cybersecurity detective, what happened, what's the immediate risk, and what should they do right now?