TL;DR: An old email address becomes a weak point if it's still linked as a password-recovery option on active accounts, still has an active but rarely checked inbox, or its password hasn't been changed since it was created years ago. Check which of your current accounts list the old address as a recovery option and update them to your primary email, run the old address through a breach check, and either secure it with a strong unique password and 2FA or close it if it's no longer needed.
An old email address becomes a weak point if it's still linked as a password-recovery option on active accounts, still has an active but rarely checked inbox, or its password hasn't been changed since it was created years ago.
What Usually Causes This
Old accounts are often reused as recovery emails on newer accounts and forgotten about, meaning a breach of that old, less-monitored account can become a backdoor into accounts you actively use today.
What to Do About It
Check which of your current accounts list the old address as a recovery option and update them to your primary email, run the old address through a breach check, and either secure it with a strong unique password and 2FA or close it if it's no longer needed.
If this looks similar to something else you've seen, it's worth reading How to Check If Your Public WiFi Session Was Compromised.
This pattern shows up elsewhere too — see How to Remove a Device You Don't Recognize From Your Apple ID.
Frequently Asked Questions
What are the real warning signs?
An old email address becomes a weak point if it's still linked as a password-recovery option on active accounts, still has an active but rarely checked inbox, or its password hasn't been changed since it was created years ago.
What usually causes this?
Old accounts are often reused as recovery emails on newer accounts and forgotten about, meaning a breach of that old, less-monitored account can become a backdoor into accounts you actively use today.
What should I do about it?
Check which of your current accounts list the old address as a recovery option and update them to your primary email, run the old address through a breach check, and either secure it with a strong unique password and 2FA or close it if it's no longer needed.
Should I be worried if I only see one sign?
One sign alone (like a slower device) is usually not cause for alarm — most single symptoms have mundane explanations. Multiple signs together, especially unexpected data usage or unfamiliar apps, are worth investigating.