I'm not sure yet how it's being done, but there is some way that people are re-activating old accounts that are not merged to b.net.

I know because I had the very creepy experience of seeing one of my very own alts (a L20 Warlock) from an account that's been inactive since late 2008 appear as logged in on my friend's list last Thursday morning. I didn't even know who it was at first, then a huge holy shit!! moment and realized it was MY character. They stayed logged in for around 15 minutes then logged out. Filed a GM ticket, called customer support and got the account temp banned for compromise investigation. I just got off the phone with Blizzard and I've gotten the account ownership reestablished, the account un-merged from the hacker's bnet account, the password reset, etc. I haven't logged in yet to see what they've done, I can't yet actually as it has to be merged with a b.net account to login. And of course the Customer Support person wouldn't tell me what had gone on other than the obvious : someone compromised the account, and merged it with a b.net account. There was absolutely nothing to steal on the account but maybe they left some goodies, I'll find out tonight I guess, going to create a new b.net account and merge all my abandoned accounts with it.

Details from my end:

It was a Classic account I'd abandoned in late 2008 and never merged to b.net.
I have not logged in to the game, the forums, or account management with that account since late 2008.
After a very exhaustive scan, I do not have any known virus, trojan, keylogger, rootkit, etc. on any of my computers.
None of my other accounts were targeted, including 2 other abandoned accounts I abandoned at the same time with sequential naming. e.g. account, account2, account3, only 'account' was hacked.
The email address tied to the account (gmail) has not been accessed by anyone other than me.
I don't reuse account names elsewhere or share my accounts with anyone. Well, my girlfriend does know my account names but does not know passwords, and hasn't done anything that could cause this old account to get hacked.


Something's up, that's all I know.