Netflix, like almost every other major site, uses https:// to login. That 's' means that your password was not stolen by someone monitoring the internet traffic coming out of your box.
Possibilities:
They didn't really have your password yet and the mail was a Phishing mail. Did they want you to click a link they gave in the email to to change it? (or did they give you a number to call? That technique requires you to give the 'operator' your id and existing password in order to change it.
Netflix.com was hacked and they stole your info from that side.
You have some malware on your device that stole your password when you typed it in. Seems unlikely if it was only on a DVD player, but then again I've not see a dvd player that was capable to getting to netflix. (Game console, yes. smart tv, yes. dvd player? That's a new one to me)
You went to a fake site like https://<hiddencharacter>netflix.com/ and manually typed your username and password because your browser seem to not remember it
you met some guy in a bar, got drunk, and told him your password.
That's about it... take your pick.