You need to try and find a common denominator between the phone numbers. Have you stored them all in the same place (ie laptop) or are they all with the same provider? If Facebook has been comprimised, were your new phone numbers on there, even if not public, they could have accessed them via the account. Did you have them on email somewhere? Email can be comprimised either via the web interface, but also via POP3/IMAP so make sure they are turned off otherwise access might have been via them. I got my Gmail hacked via IMAP and didnt spot it on the web interface.
Key logger is certainly a possibilty. You dont have any kind of remote access to the laptop that X could be using?