Phishers could trawl for information in order to find other accounts using the same email/password combination, so hopefully you've already set up unique passwords for services (including Netflix) and are using multifactor authentication where available (unfortunately, not yet on Netflix). They also may resell access to active accounts on services like Netflix or Spotify, so it's a good idea to check recent streaming activity for any IP addresses you don't recognize -- just don't forget about that cousin who you said could use your account. You can also sign out all active devices and reset your password on the Netflix website, and its support page recommends forwarding any suspicious emails to phishing@netflix.com.