why don't u try scanning on ur sys!
may be u find out an open port is not supposed to be open.

may be ur firewalls aren't running properly.or if possible try running an IDS on ur sys.
this way whatever data is going out of ur sys,u can see that.
i don't think there's any other way for the guy to get ur passwd but from ur own sys.