A 3rd party leak doesn't mean you signed up on some dodgy RS item duplicator website or anything, data breaches can happen for major corporations which you may have signed up with using the same email / pw combo, an example is Yahoo
https://www.pindrop.com/blog/500-million-users-affected-by-yahoo-data-breach/
Hackers may target runescape accounts rather than paypal/credit cards because it's an easy way to get money without facing prosecution, you can check your email at the link below also
https://haveibeenpwned.com/