My first suspicion would be that your browser was somehow tricked into sending the HTTP requests needed to withdraw the coins to that address while you were already logged in. Either by some clever hack or because you clicked a link you shouldn't have.