Well that escalated quickly. Theymos can check my IP records tomorrow, I'm on holiday through Europe but I return home tomorrow and will be using my account from my normal IP.
Address sent a transaction I didn't directly authorise. I think it may have come from one of my projects connected to my blockchain.info wallet (yes, yes, idiot me for using it).
False alarm.
My account wasn't sold. I actually use the 1KQ address for almost everything in my life, I hate having to use different addresses for every transaction and blockchain makes it easier for me to keep everything in one place because all the change is sent back to my address.