I know your didn't. Someone has access to your information and is making these changes, since every change ultimately runs through your email account, it's the weak link, and why the thief changed it. So you wouldn't see the warnings.
There may be no way to stop the cycle without closing your ATT account. But it may repeat if the thief is getting a peak at your email accounts.
I use gmail with 2 step verification. https://support.google.com/accounts/answer/185839?hl=en