I hear people making that claim very often, but is there actually anything to support it? If I as much as try to log in to my account from my laptop rather than my desktop it won't let me until I confirm via e-mail that it's in fact me, and set a new password. So unless they actually get their hands on your e-mail account as well, they can't just go and steal your FFXIV account.
