You should definitely start changing your passwords though, because the wallet changes were confirmed via email, meaning the person has/had access to your email. The wallet was not locked.
I'm interested to know why BTC Guild doesn't have the option for 2-factor authentication, most other pools do (and yes, my wallet is locked!).