Has anyone else experienced this?
Not I. I also use canary email aliases. Perhaps someone brute forced your login? Perhaps email dang and share what IP addresses/ranges your login should show up from and ask if any logins do not match those addresses. hn@ycombinator.com
Do you by chance use a HN specific UI App on your phone? The concept of those has always made my spidey senses tingle.
The (different) address I use for the HN jobs threads gets only spam, though.