Has anyone else experienced this?

Not I. I also use canary email aliases. Perhaps someone brute forced your login? Perhaps email dang and share what IP addresses/ranges your login should show up from and ask if any logins do not match those addresses. hn@ycombinator.com

Do you by chance use a HN specific UI App on your phone? The concept of those has always made my spidey senses tingle.

Come to think of it, I used the same email address at YCombinator's https://www.workatastartup.com

I'll change it on that end and see if it's coming from there.