on thursday night my roommate found that he could not logon and his id/pw was incorrect.
on friday morning, we call pol, get pw reset, and nothing was taken, character wasn't even moved.
later on friday evening, my other irl friend found that he could not logon and his id/pw was incorrect, he called pol and got his pw reset, and him too had nothing taken or moved.
my roommate and other irl friend both use firefox+noscript, have updated flash, never goto somepage, ect. and have scanned with AVG to find nothing suspicious.
I regularly use both of their characters (in addition to mine and another character), so it's possible that I was the leak, but my character and my 4th account hasn't been touched yet. I also use firefox,noscript,ect ect ect, and avg turned up nothing.