Really sorry this happened. Yeah, keys in a memo, or logging into a phishing site, which can happen from bad links are the most obvious ways someone can get your keys.
I understand your anger and frustration, sorry to hear it.
Posted Using LeoFinance Beta