Received ransom email containing my password. How did they get my password?

Question

Finally, even I got the fabled ransomware emails we've all heard about so much.

First, let's look at the facts before I get to my question:

1. I use Mozilla Thunderbird as my email client.
2. I was using at least one VPN (one on the system, possibly another via the browser (Opera)) at the time that the events below transpired.
3. Recently I revisited a (relatively well known) web forum I was active on many years back. I tried a few different email/pw combinations to log on to the forum. None of them worked - either because the pw was wrong or the account was no longer active.
4. I tried logging in using different browsers.
5. So I searched in my mail client for the forum's name (hoping to find some communication from the forum to check which email account I actually used on it) and found a few old emails one of which contained the password (see next point also).
6. I was on this forum when it was still in its early days - and the then admins thought it was a good idea to send people an email saying your login email/id is xxxxxx and your password is yyyyyy (yes, in plaintext).
7. I tried the newly discovered old password, and it didn't work.
8. It wasn't terribly important to visit this forum, at least it wasn't worth the trouble. So I gave up on this and moved on.
9. When I checked my email this morning, I find this email in the junk folder of a different email id, not the one I used previously for the forum, as mentioned in point 5. The email reads:

I know yyyyyy is your pass. Lets get directly to point. No one has paid me to investigate about you. You may not know me and you are probably wondering why you are getting this email? Well, i actually installed a malware on the X videos (pornographic material) website and guess what, you visited this site to have fun (you know what i mean). While you were watching video clips, your browser started operating as a RDP with a key logger which gave me accessibility to your screen and webcam. after that, my software gathered your complete contacts from your Messenger, Facebook, and e-mail . Next i created a video. 1st part shows the video you were viewing (you've got a fine taste : )), and next part displays the recording of your cam, yeah it is you. There are two choices. Let us take a look at each of these choices in aspects: First solution is to disregard this e-mail. in this instance, i am going to send your very own videotape to each one of your contacts and thus think about regarding the disgrace you will get. Keep in mind should you be in a committed relationship, exactly how it will eventually affect? Second alternative is to pay me USD 969. i will think of it as a donation. in this scenario, i most certainly will immediately delete your video footage. You will carry on your way of life like this never took place and you will never hear back again from me. if you are looking at going to the law, surely, this message cannot be traced back to me. I have covered my moves. i am just not looking to demand so much, i simply prefer to be compensated. email message%}. if i don't get the ‌bi‌tco‌in‌, i will definately send your video to all of your contacts including membe rs of your family, co-workers, and many others. Nonetheless, if i do get paid, i'll erase the video immediately. If you want to have evidence, reply with Yes and i definitely will send your video to your 8 friends. it is a non:negotiable offer, that being said do not waste mine time & yours by responding to this e-mail.

The interesting thing about this email is when I hit Ctrl/Cmd-A, or select the empty space between paragraphs, I can see a lot of other text between the visible paragraphs. So this other text is formatted to be the same color as the background. This other text essentially consists of my email id (sans the @gmail.com part), the password text, and interspersed with random text like jejyzsz, yogdyle, xaue, zsrryzwob, gykucagex. Presumably this is to disguise the email from (spam and other) filters. Or is it something else?

Next, my take on this:

1. I haven't used that password in ages, so I don't really care.
2. The webcam on my laptop is always taped over, so I don't really care about what kompromat video they might have on me either.
3. I won't be replying to them, and will wait/watch if/how they follow up.
4. The email mentions getting my contacts from Facebook and Messenger, but neither of those are installed on my laptop. So this seems to be an automated operation.

Now, the real questions:

1. How did they get that old password?
2. How were they able to relate the two email id's - the one which had received the ancient email containing the password in plain text, and the other email id, which received the ransom message?
3. Edit/add: **Yesterday I tried to login and later viewed the email containing the plaintext pw and today I receive the ransom mail. (How) are the two events related?? I find the timing a bit suspicious...

Edit/add (after a remark in an answer): the two email id's are very similar. If one is FirstLastXXX the other is FirsLastYYY where XXX and YYY are numbers. But the original email (the one which was used to sign up and which also had received the email containing the pw in plain text) did NOT receive any ransom messages.

The possibilities (as far as my limited imagination goes) are:

1. From the forum's servers
2. From the browser, via an exploit
3. From the VPN servers
4. By hijacking the connection
5. Completely random, but extremely extremely unlikely coincidence. 
6. From the mail client, via an exploit. 
7. Via malware on the local system
8. Compromised ad network server somewhere
9. What else????? 

1, 2, 3, 6, 7 and to some extent also 4 - if any of these are/were compromised, they could have had access to much more than an ancient password.

So what do you think is going on here? I know what I should do, but the question is how could this have happened?

Interesting bits from the mail source:

ARC-Authentication-Results: i=1; mx.google.com;
       spf=neutral (google.com: 31.40.49.135 is neither permitted nor denied by best guess record for domain of [email protected]) [email protected]
Return-Path: <[email protected]>
Received: from fajuxeguz.com ([31.40.49.135])
        by mx.google.com with SMTP id g4si9835035ywe.174.2019.04.22.10.22.18
        for <[email protected]>;
        Mon, 22 Apr 2019 10:22:20 -0700 (PDT)
Received-SPF: neutral (google.com: 31.40.49.135 is neither permitted nor denied by best guess record for domain of [email protected]) client-ip=31.40.49.135;
Authentication-Results: mx.google.com;
       spf=neutral (google.com: 31.40.49.135 is neither permitted nor denied by best guess record for domain of [email protected]) [email protected]
Received: from unknown (HELO m1.gns.snv.thisdomainl.com) (Mon, 22 Apr 2019 13:07:45 -0400)
    by relay-x.misswldrs.com with LOCAL; Mon, 22 Apr 2019 13:07:45 -0400
Received: from [198.165.237.20] by smtp.doneohx.com with SMTP; Mon, 22 Apr 2019 12:59:11 -0400
Received: from smtp.endend.nl ([187.194.89.225]) by mts.locks.grgtween.net with LOCAL; Mon, 22 Apr 2019 12:57:51 -0400
Message-ID: <[email protected]>
Date: Mon, 22 Apr 2019 12:57:51 -0400

That IP address translates to a .ru domain. But that doesn't mean a whole lot.

Please do help edit the question/tags, if you feel it necessary.

Answer 1

1. From the forum's servers

Very likely this one. There are lots of password dumps out in the wild and they used on of these. The other options would mean too much effort on their part.

How were they able to relate the two email id's - the one which had received the ancient email containing the password in plain text, and the other email id, which received the ransom message?

You provide no details about these addresses so it is impossible to tell for us how they might be related. But I've seen for example use the same password on similar mails (like similar user part, similar domain part, sometimes just some characters cut off the username ...). They might of course correlate users by used nick names etc but again, nothing is known about your different addresses and how and where they were used.