twinset - if password is (was) in any way obviously identifiable (kids name, your / their date of birth maybe / maiden name / home town / mother's name / dh's name etc. they perhaps simply 'guessed' it from knowing some small bit of information about you, perhaps even gleaned from something like that 192.com site that has been linked to a few times IYSWIM...
e-mail addresses even posted on MN, or URLS pointing to photo albums that have your RL name etc. etc. can, very often help a hacker guess / derive usernames, and /or passwords. People (and I'm not saying you) often are fairly lax wrt this sort of security.
Also, think of how many websites we all register at (including of course MN, but possibly dozens or even hundreds of others)... where our preferred user name is often the same, or it's an obvious first initial / surname type of thing, and our password is often the same too, across dozens of sites, so an employee / site owner of some small / obscure site might then use your data to attack your id at a larger site IYSWIM...
Trojans can log keystrokes, dump your output from a few minutes / hours / days to another server on the net etc. if it has compromised your firewall. Parsers can then search for something like 'www.amazon.com' and then extract the next 50 keystrokes, which might be you entering your username and password... and bob's your uncle. This is obviously automated and the program to do this could spread like a virus / worm.
There are also keystroke loggers which can go inline between the end of your keyboard cable and your PC, which just look like little grey plastic thingies (like ordinary kosher PS/2 to AT adaptors) and perhaps a PC in a public place (like work) has been tampered with ? It is not unknown for this to be used by suspicious spouses etc.
I don't know what might have happened in your instance, and of course it might be none of the things I've outlined, but I would (as always) mention that IMHO an Apple Mac is far more resistant to virii and malware / Trojans than a PC. This would offer you nothing if the hack was derived by social engineering or a keystroke logging dongle, but spyware / Trojans on the Mac platform are, currently, essentially non-existant. Food for thought in my book.
If anyone feels any of that was particularly useful I'll bung it into a 'computer security' thread. It really isn't nice when it happens to you.