1. The account name has been used only as a character name before (obviously different to my screen name & character names in game). However, the combination has not been used before. It seems slightly preposterous and equally ludicrous to suggest that every single character in Elysium is unique.
2. No, the latest add-on I would have downloaded would have been almost a month prior. Also, I scan every .rar file I download prior to extracting. Further, this presumably would only be effective if I was logged on, unless it operated as a keylogger, in which case see prior sentence regarding scanning each file. I definitely logged out with the gold, as I had just put some items on the auction house.
3. I would love to set up 2FA if my email provider didn't keep delaying the receipt of my emails.