My empty Mt. Gox account used the same password as my nearly empty BPM mining account. Just before 7AM EDT today someone tried to change my wallet address to:
1GM5hnKBFm2nJB4KLsFPrh55EKNwQjog4W
If you look at this address on block explorer you'll see that it started receiving coins today and has mostly gotten small amounts, presumably from doing what he tried to do to me (but failed at, because my email address has a different PW so he couldn't confirm the change).
I suggest you blacklist this wallet address from receiving coins from BPM and alert those accounts who were switched to it.