I would suspect you've been sniffed via a bad TOR node.

This has been happening a bit more often as people are running more and more rogue nodes on the tor network.

Your basic login info gets sniffed out on the tor relay node, they get your login details in plain text basically.