If I have a business and I use a company like sendgrid, I have credentials to use that service. If some employee has access to that account (such as to send newsletters), and that employee’s credentials were lost or stolen, that doesn’t seems suspicious at all.
I don’t have any inside info here, but it makes sense. And as a namecheap customer, I see no reason to panic at this time.