Had exactly the same issue with a recently holiday. Basically never click on a link in an email go via the Booking.Com account. I spoke to the hotel involved and apparently it was them who had been hacked. Booking.Com said they were looking in to it but never heard any more from them.
Is taking 2 of the Barnsley 297 back to the scene of yesterdays humiliation for Sunday lunch a bit harsh.......at least we spared them the stadium tour!