Yeah you're probably best off getting an authenticator. I'd previously been against them as they shouldn't be required (and I mean I spent £40 on the game and then £10.50 on the dongle, so that's like 25% extra; it's not an insignificant cost), but with the sheer number of hackings going around (more so than I've ever heard of in another game) I don't feel like the standard security in the game is enough. It scared me enough to buy one anyway. The rumour going around is that the hackers usually only strip one character which is the last character you played, and then your stash. This might be because they have a bot doing the stripping, or because they just don't want to hang around too long in peoples accounts, I don't know. But supposedly if you make a level 1 alt and always leave that as your last used character when you log out that will make it less likely your main gets stripped (though your stash will still be a target). That's just the rumour, so don't think it's a good replacement for the authenticator.
What sucks is that nobody seems to have found a reason for their compromise. I haven't seen a big spate of phishing emails going around, and nobody has admitted to finding a keylogger on their system. You'd have thought with the quantity of cases that someone would have found something, even if all the events aren't connected. As for the session ID rumour: there are some clever people out there, and if this was true you'd have thought someone with a good heart would have found the exploit by now and tipped Blizzard off. I'm still amazed at the number of people being hacked; it happened in WoW, sure, but this is on another scale completely. Or at least it's being talked about a lot more.