But anyway, I agree with you that the most likely scenario is the characters were logged- the first thing I would do is check all your running processes and see if any are Trojans or viruses.
Allowing two way authentication will solve this risk.
Maybe "Google Authenticator" ?
Yes, this is what i thinking & still no see any coin have feature require Email verify or GAuthenticator for transactions.