I am hesitant to post in such an ill-tempered thread, but the conversation linked above is, simply put, terrifying!
If there really is a trojan out in the wild capable of doing the stuff Baritus wrote, the implications are catastrophic.
Speaking as a code-blind person, would it be wrong to assume that one or all of the exchanges (I think there's eleven?) could be literally sitting on a time bomb right now? 

through some PHP bug(I'm guessing) or some trojan that's going around, some hacker was able to reset password on c ave
for a few users
not sure how it's possible since I already looked at all my code and it doesn't allow for it ever
and the other odd things is, they were able to get the verification email codes
from the user's email accounts
which I am not sure of how they did it either
good news is, I had detection kick in that locked out those accounts
so I still have everyone's funds
but the bad news is, someone has a trojan embedded in a lot of crypto community or some unknown bug in PHP makes it completely insecure