I'm working on this, I've only known about it for about 2 hours. I'm checking logs, changed passwords, and am trying to figure out how and if this can happen again.
I do not know if it is related, but claymore miner is giving me this error:
ETH:: No new jobs were received for 10 mins - something is wrong with the pool (or check -ejobtimeout and -djobtimeout options), disconnect.
Yes, that was related. It's fixed now, I believe I've also plugged the hole that allowed the eth to be stolen. To test it I sent some eth to the pool account.