I use both MFA and a password manager tool for security purposes, and the account is connected to my work email.

I am pretty sure that no security flaws was the cause of this, except pushing to the private repo.

I have checked the transaction and the commit dates, which are matching perfectly. No doubt about that.