Do not think any hacker would suddenly change his details,if anything they leave it as is hoping that he does not notice the withdraw. Seems like some one may have looked at the users in the promo and took a quick crack at their passwords in a attempt at some free cash.