I would suggest you look at your email security settings. I can't remember the last phishing email I got, but I use gmail with medium security. Seems to work.

It could have already been compromised.

Almost no doubt, and a change of password, and a virus/malware check are now due.