Back in the day I used to be a regular WoW player playing by hand. Have a pretty nice account that's been inactive since last year some time. As I was getting breakfast this morning, my mom is all "Why is your account logged in did you reactivate?" So I'm like wtf, and sure enough, my character is logged on in Wintergrasp. I go to log into the account, password was unchanged but there's an authenticator on it now (definitely not mine). I was able to change the pass so they can't get back in if they log, but still waiting on some emails from Blizz. On a sidenote, my bot accounts are all untouched, and I know I haven't ever been keylogged, I know the net well enough to avoid sketchy stuff. I just found this really weird, and thought I'd share it with someone, see if anyone knows how this might've happened, whatever.
most of the times that comes from a keylogger or if you play on public internet spots or if you share your info with friends or something like these