It was a password that I only used with iTunes, or at least, I thought it was. You may be correct. I'm more vigilant with my passwords these days.
Even if the password was unique to iTunes, a key logger on your computer could have intercepted it.
Does Apple always use HTTPS? Otherwise it might have been intercepted when you were on an insecure wifi network.