But they have my old password, so if they indeed got their hands on in my email would it be possible for them get access to my phone contacts as well? And the documents in my onedrive as well?
The problem is that often the username is the email address, for example:
name:
user@gmail etc.
password: hgehshdje34
Of course, this explains why the scam is delivered to your email address because your credentials are probably stolen from online archives.
But this criminal will probably send thousands of these hoaxes in automatic and random mode, you're not a specific target and he is not interested about your data.
He only wants your money and stop....you don't have to respond, pay and worry about this despicable scam.