Update: my IT guy called my password system 'a house key under the mat' and I switched everything
He said using the same 3 passwords with a year stuck on the end was why a phishing email in March got into my work email, so now I use a password manager and a separate random one for my bank.