1. Did you access your account from a public computer? Maybe you forgot to close it down.
2. Is it possible it could be an inside job? When you call SPG, they often ask for your password. It would be very easy for you account to be compromised that way.
By the way, on the above, can you have two passwords? One you use for verbal confirmation and another to log in.