Definite maybe.

The billing address has my address included but the outgoing address is something completely different. I check my past login devices but I couldn't see anything out of the ordinary.

Seems like they refunded the thing and banned the payment method without me having a penalty. They called it a “one-time exception” so I’m probably lucky.

You exposed your login credentials:
a) Either by logging into a site that faked a Steam login and made a bot log into your account using the save password as well as the trust device feature while injecting a Steam API access into it.
b) Or by installing malware that stole your session data or injected a keylogger.
c) Or by using outdated login information that got exposed in a leak.
d) Or by falling for a Steam Support impersonation scam on Discord or similar platforms.

1. Scan for malware using any reputable antimalware program.
2. Check that the email and phone number on the Steam account are still yours.
3. Ensure your email address and/or password aren't contained in any public breaches. There are various sites that allow you to do that.
-- If they are contained in any public breaches, change your email account's password from a secure computer before proceeding.
-- If that happens, you may want to secure other accounts than just Steam.
-- Consider using mobile two-factor authentication on your e-mail address if your e-mail provider supports it.
4. Deauthorize all devices INCLUDING the one you are using (You will have to relog after you click it): Steam -> Settings -> Security -> Deauthorize All Devices or https://psteamproxy.yuanyoumao.com/twofactor/manage
5. Change passwords from a clean computer
6. Generate new backup codes for your Mobile App https://psteamproxy.yuanyoumao.com/twofactor/manage
7. Revoke the API key https://psteamcommunity.yuanyoumao.com/dev/apikey (there should be nothing in the APIKEY)
8. Change your trade link: Profile > your inventory > trade offer > Who can send me trade offer > scroll down and make a new trade link.
9. If points were stolen within 14 days, reset your Steam password (not change, RESET using Forgot Password) to cancel pending awards.

I assume it's a stolen session token file which usually does not display as a new login

Yeah, thanks for the list of things I should do. You’re a life saver.