You most likely have a Dynamic IP Address if it's not you logging on anywhere else, or you're keylogged, in which case every time you change your password it's still stolen (If you've already scanned for viruses/malware then it's not the latter).
A Security Token would help for both cases.