Hacked account, how did they do it?

As others have said, get an Authenticator.

You can go with the Key Fob version, or an application on most Smart Phones.

Then the choice is one Battle.Net email with all accounts on the same email. This gets you easier account management (via drop down boxes to switch accounts) from a single log in, and a single authenticator code. It also means, you need to log your accounts in one-after-the-other with a separate authenticator code for each.

Alternatively, go with five Battle.Net accounts, with one Warcraft account per Battle Net. Then link the same authenticator to each Battle.Net/Warcraft account. This means you will need to log in five times, for account management changes, but that you can simultaneously log into Warcraft with all of your accounts at once, on a single Authenticator code.

I went with the second option, since I log into the game more often then change payment details on my accounts; I'd rather have the faster log in, then the faster game management.

I used to think the 30 seconds between logins was long, but considering all the time it took to get all my accounts and characters back from being taken over by hacking idiots, it's worth it.

I last played in December of last year, before RL decided to slam me down and punch me in the kidneys. All 5 of my accounts were reactivated and hacked in April. I hadn't been playing and the accounts were frozen. Someone paid subscription on all 5 to strip them. I did get an email from Blizzard notifying me of a password change to which I responded in early April and got the accounts at least secured. No idea how they got my password since I hadn't bothered to even access, or pay for the accounts in 4 months.

Now I'm trying to get shit restored and one of the accounts unlocked since I'm thinking about coming back.

Needless to say - I'm ordering an authenticator on Friday if all goes well with Blizzard. I would highly recommend it.