I remember back in MoP I had my account compromised (attach an authenticator!)
They only touched my Druid, didn’t even take my gold on alts or anything. Just had me in Balance spec and moved my professions to Mining/Herb.
I’d bet they are using compromised accounts to bot and sell the gold RMT. 