TL;DR: An unknown WiFi extender showed up in my DHCP logs and my phone routinely connected through that access point. How badly was my network or traffic at risk?
This morning, while struggling with a slow connection I checked my router and was surprised to see a new, unknown device connected via DHCP. The Host Name was listed as "TL-WA850RE" which turns out to be a form of WiFi signal extender. Since I don't own such a device, I immediately added the MAC address to the exclusion filter.
I kept an eye on the network since then and didn't get any more issues. However, I noticed that my phone suddenly had random problems connecting to the WiFi. I didn't make the connection between the two until I finally got fed up and decided to change my wireless security to use WPA2 instead of the WEP I was using (for a legacy device, it's stupid, I know). Right after, I discovered that my phone suddenly found two different networks with the same SSID but different security settings. After changing and hiding my SSID, the old SSID is now still listed.
All this lead me to the following conclusion: someone broke my WiFi "security" and configured a repeater to extend its signal, thereby impersonating my network by serving as a second access point in a multi-AP network. Because my phone was closer to the repeater than my router, it was going through that access point. Since I had blocked the MAC from accessing my actual network, that connection then no longer worked.
So now my question: is this actually what happened? How worried should I be that someone was listening in on the traffic my phone presumably sent through this unknown access point? Should I take additional measures?
EDIT: I'll see if I can export any logs from the router to check past activity. I ran a port scan on the device which showed an open HTTP port, presumably its management console. I briefly considered trying to access it but while that's morally defensible it's probably also illegal and unlikely to provide any useful information.
EDIT 2: As I feared, it's a Belkin router with as much logging as the Sahara desert.
EDIT 3: As it turns out, a technician apparently installed this particular WiFi extender as part of an installation of a solar panel array. Not to boost the signal but because the extender has an ethernet port which connects to the power converter so it can report usage statistics. Of course they neglected to mention this to the person who's actually in charge of the network. Still, I've found the answers here quite helpful and perhaps this question can be useful to future readers who do have a malicious AP on their network.
Note: I have a fairly good idea of who it was that's been messing around on my network but I wanted to make sure that I understood what happened before confronting people or notifying authorities. Odds are I may do nothing if I can be sure that they only mooched off the wireless and didn't get anything else.