I created an Inputs.io wallet a couple of months ago with a good password and 2FA enabled. I deposited 0.1BTC from a blockchain wallet to check out the interface.
The last time I logged in was Oct 2.
I just received an email saying that 0.095BTC had been transferred from my wallet. I did NOT initiate or authorize this transaction.
I've sent an email to Inputs.io support and they replied within 4 minutes saying that they will look into it.
I just looked into some transactions of this wallet and it seems it sent money to another account, which in turn sent money to another and so on. Eventually it ends here:
It seems that there's multiple "forwarders" that collect money in small amounts from people's accounts and then pass it on 5-10 times before reaching the above mentioned wallet.