Another possibility would be that you clicked some "evil" external link on the official WoW forums that (afaik) use the same login as the game. That linked page would use javascript to extract your login cookie and getting your password in some way. I think that only worked with IE though.
