Spammer/Hacker logged into my account and created a character to gold sell?

[Noata]

Have fun trying to brute-force a randomly typed password when there are billions of other possible passwords. Brute-force really only works for weak password, otherwise you need to extract the hashes from SE's servers

Not entirely true, rainbow tables have every possible compilation, even a very complex password that is not more then 10 characters can easily be hacked. often times though the use of malware is involved, usually they attack fan sites that are poorly defended from intrusion and work toward stealing account info. this has proven to be a reliable source for password comparison. An average person might be content with using the same password and username for everything they do with a particular MMO.

I would more likely bet a fan site than anything else. a brute force attack only works best when you have confirmed information. keyloggers and other malware tend to not have the functionality necessary on a PC with default User Access Control *UAC*. Also some anti-virus run heuristic scanning, which would stop applications executing a certain type of behavior.