android phones can do the authenticator too.

if you haven't got any trojan/virus on your pc it is most likely that they "hacked" some forum/shop/site where you are registered with the same credentials as your wow accounts :-)