To anyone who's interested:
My WoW account was hacked yesterday. A friend messaged me saying that I was apparently online through SC2 (when I actually hadn't played for months). I checked my armoury account and it said I'd been playing and receiving items over the last few days.
After some frantic patching and malware-searching, I eventually logged on to find that my character was completely unscathed, my gear was all as I left it, I had more money than I remember ever having earned on my own, and there were two new level one characters on my account, one of which had a small amount of gold on it.
Basically, someone got into my account, paid for a month of game time, ran a dungeon a couple of times and and gave me a couple of thousand gold, doing no more harm than removing my character spec and shifting some icons around on my action bars.
Oh, and I've attached an authenticator now. They won't be getting in again.