http://us.battle.net/d3/en/forum/topic/5149539239
Basically don't join public games
Bots are stealing session IDs and accessing accounts without needing the password and account name
Edit: it seems to be affecting people outside public games too