There must be someone on the inside, or the pooling software has some kind of security hole in it.  I know it isn't because of the Gox debacle, because I didn't use the same password or username.

Damn Hackers