Appletv Possibly Hacked

So this afternoon around 4:00 I had a payment confirmation email come through stating that I made a purchase of around $14 for appletv services. Contacted my wife who said she didn’t make this purchase. Cancelled the service at that time.

When I got home around 5:30 I checked the Appletv app and noticed that someone was watching Widow’s Bay. It was on episode 3 and had 14 minutes left of the episode. Checked again just now and episodes 1-5 have all been watched in full.

Is it possible to know what device made the purchase or what device is streaming the app? Checked forums and haven’t had any luck in this regard except for them all telling me to do the settings thing in my phone to see what devices I’m signed into. I have done that and it’s only my home appletv, my iPhone, my extra iPhone that in my side tv cabinet for pandora use only and my kids iPad (does not have appletv app). Confirmed kid didn’t do it because he doesn’t have app. Plus apple always has a 2 part authentication which makes this even more confusing

Is there a way around the 2 part? I have already changed my password so all of my Apple devices will require the new password.