Were you using your posting key to login? If not, only use that key.

In order for you to have been taken advantage of like this is if you used your owner key for logging in.

The owner key is the master key for the account and is required to change the other keys.
The private key or password for the owner key should be kept offline as much as possible.

I hope things get straightened out for you. :)