Is everyone that is hacked only seeing items being stripped from the character that was last logged in? If so, it's interesting to me that other characters on that account with better stuff are not being touched. It makes me think the hackers are getting in without being able to access the character select screen, which in turn makes me think they've found a way to obtain limited access that doesn't involve passwords or the authenticator process at all.
It's probably just someone using a bot to go through a list of users/passwords.
Think about it, using a very basic script like this, you have it make the exact same clicks everytime. You don't know how many characters each person has, so the simplest thing to do is just set up a script that takes the current character and joins a normal act 1 game and cleans out what is in the stash and on the character. Stash/vendors/join game/etc are always in the exact same spot. You don't have to do any kind of pixel comparison or anything to determine what characters the person has, and it works for any account that has any characters at all. It may not maximize the amount for each account, but the reliability and speed that it can go through the accounts probably makes up for it.