Could this be caused my session theft?

I got redline stealer a while back and removed it and changed passwords and enabled 2fa. 2 months later my accounts got hacked but there was no suspicious logins or anything. They changed my location to Singapore and then tried to sync to it with a Singaporean ip which failed. and some got the password changed that’s how I knew. Is it possible my sessions were still valid after that time even after changing my passwords? (Outlook and gmail) also my school email was hacked but when I close the tab it signs me out. Does this look like session stolen?