Looking for some advice.

Last month I came home from work to find a ton of emails from my ebay account, most of them relating to items I'd supposedly put up for sale (which I hadn't). Thankfully Ebay realised it wasn't me and suspended the account. I changed the password along with all other ones I use on my computer and assumed everything was fine. A couple of days ago I got another email from Ebay

We have reason to believe that your eBay account has been used fraudulently without your permission. We’ve reset your eBay password. Any unauthorized activity, such as buying or selling, has been canceled and any associated fees have been credited to your account. Any listings that we removed are included toward the end of this email. We assure you that your financial information is securely stored on a server and cannot be seen by anyone.

Although we’ve taken steps to secure your eBay account, your personal email account or third-party listing tools may have also been accessed without your permission. Please change these passwords as soon as possible.

Once you’ve secured your personal email account and third-party listing tools, please change your eBay password:

Select the Sign in link at the top of the eBay home page.
Select the Forgot your password link.
Enter your email or username, and then select the Next button.
Follow the instructions to change your password.


Given all this is there anything more I should do in terms of security? I've run pretty much everything I can on my Norton security and changed passwords.

Thanks

Lots, yes.

Zeroth, are you sure that this one is a genuine email from eBay and not a phishing email (perhaps the person who first compromised your account is trying to dupe you into visiting phising sites or otherwise giving up your new information)? Be very careful.

First, Norton is not very highly recommended and hasn't been for years. Most of us would suggest you replace it with a good (free) alternative and scan your machine with that. Avast, Avira, BitDefender are all good examples.

Second, you should also download the free version of Malwarebytes Antimalware and also run a scan with that.

Don't use your computer for anything sensitive in the meantime.

Third, you should really be changing passwords from a clean computer, since yours might be compromised. Change (again) the passwords - and security questions/answers and any other reset mechanics, including connected accounts - for your eBay account and the associated email address (and Paypal and other funding sources too would be a good idea). Do this from a different (known clean) machine while you're still cleaning yours. Use strong passwords (long, not dictionary words unless a string of random ones run together, etc etc). Do not use true, predictable or researchable answers to security questions.

If you use an email service that lets you review login information (Gmail does this for example) then work out whether someone has been accessing it from unknown locations etc.

Regardless of the email service you use inspect the sent items and deleted items etc for evidence that it has been used by someone else.

The email above mentions third party listing tools. Do you use any? If so apply the same rigours to them.

Check that you are not logged in to these services on other devices and computers. Think very hard about where you might have logged in in the past.

Come back for more guidance but that's off the top of my head for starters.

Thanks for this. The mail from eBay is genuine as I always go to sites directly rather than through email links. My passwords the last time were all pretty complex but I'll definitely use a clean machine to come up with new ones.

Can you explain this?

It makes zero sense to me!

Meaning he didn't click a link in the email to change his "new" password, the way John Podesta did.

Yeah this.

Right, so... the mail may or may not have been genuine but you took the prudent course of action in responding to it.

My point was in part that your account might not have been genuinely compromised the second time around.

It appears it was genuine as I couldn't log in and had to create a new password (which I've done on a clean computer)