Changing all your passwords and enabling 2FA was the right step. Make sure all the passwords are strong and that you set a different password for each site (a password manager like KeePass makes this easier).

As to where it came from, check to see if your email address is in the breach database at https://haveibeenpwned.com/