This. The uni in question should have an
[email protected] address (or similar, Google it), they'd appreciate it if you forwarded on the email with a "looks like you've got a compromised account" message. They'll be used to dealing with this sort of thing, as academics have a tendency to be...