This isn’t an area that I’m very familiar with, but a general knowledge of how installations (free or otherwise) have to be linked to your avast account at my.avast.com.

So this I believe is more than likely because in your my.avast.com account your license/s are also recorded. When you install you essentially have to pair/link (sign in) to to your my.avast.com account. In doing so that may well have had your previous installation and its assigned license.

As far as how easy it would be for someone else to log on to your my.avast.com account - that really has to be how strong a password that you have used and how secure you keep your password. The my.avast.com login/sign in is under https (secure encrypted) so shouldn’t be able to be seen by others. I think the main thing is keeping it (and other passwords) too yourself.

There is also the Avast Passwords function that should also be in the AIS to act as a password manager and keep them secure.