Identity theft question

UPDATE:
Okay so just wanted to post here that I’ve figured out what happened. I was wrong about an old password being a part of this, although I have gone and changed all my passwords. As I was going through the emails I realized they are all subscriptions, they weren’t actually trying a password to access any accounts, just signing me up so that it spammed my email account. So I googled it, it looks like what happened was my email address and credit card information were the only things compromised, and the email subscriptions were all done by a bot just to hide the unauthorized credit card charge (as it was in the middle of almost 2k emails). Thankfully Amex denied the charge immediately and identified the fraud, so it was all just an annoying hassle on my end to unsubscribe from anything that was successful (a lot weren’t because they sent emails asking to click on a link to confirm). So yeah, thanks to everyone that responded, I appreciate it!!

Original post:
Hey, sorry if this isn’t the right subreddit to post this in, if there’s a better one please let me know.

I woke up this morning to a fraud alert from my Amex (they stopped a fraudulent charge while I was sleeping for about $2500), and to almost 2k new emails from various websites in all different languages asking me to confirm Registration or confirming my registration. I believe one of my old passwords (haven’t used in years and I was previously notified of being in a breech) was obtained along with my email address, and somehow they got my credit card info (no idea how) by someone in China (one of the confirmation emails actually had the person registerings IP address) was trying to use it to see if they could gain access to any accounts I have online. These seemed to be totally random however, I went through all emails to check to see if there were any websites that were familiar, there weren’t. I think the only really annoying this is I seem to now be signed up to a bunch of mailing lists, ugh.

Anyways, besides the Amex (card had already been reissued, and charge was denied) and my e-mail address being used, I can’t find any other issues. I changed my email password just in case, and went and froze my credit at all three credit bureaus just to be safe. But is there anything else I should be doing that I haven’t thought of?

Thank you in advance!!!