Yeah, the only real way to prevent this is make sure your AL password is different from all other passwords. As Cinco mentioned, the way that they "hack" accounts is just by using database websites and crossreferencing leaked passwords to usernames/emails and trying them on AL. That's how they did it to Harlequin, and that's how they can do it to you.