I am not an avid fan of altcoins but I do use MyEtherWallet or Metamask before I start becoming serious about bitcoin. The correct would be -- Are you using the legitimate metamask browser extension?

As far as I know, there has been similar numerous incident wherein their token are being transferred out from metamask to another wallet without the permission of the wallet holder. One of the most common issue is clicking on a malicious airdrop/ links which may compromise your device before you have realized it.

Similar issues on this link.
[1] https://github.com/MetaMask/metamask-extension/issues/3132