To add to Stang's advice, you also should practice safe computing. For safe practice, you should try to scan your computer with your antivirus software once every week (and probably the same with your other scanners as well if you want to be on the safe side, but it's not necessary, IIRC, unless you do suspect you have an infection).
For the password issue, if the password is weak, then it's pretty easy to hack into an account just by using those words that can be found anywhere (such as, for example, "toast"). If the password is strong, as in consisting of letters and numbers and possibly capitalization and symbols), it's more than likely they were infected by a keylogger or a worm that dropped a keylogger.
Also, if you're using the Window's firewall, you'll want to install a third party firewall as the Windows firewalls are usually insufficient compared to the other firewalls out there. You can find that here in
Freeware Replacements for Common Commercial Apps. Of course, if the antivirus software that you have installed already has a firewall with it, you can leave that as is. Just make sure that (like an antivirus) you only have one running.
One important thing, of course, is to not download any hacks or 3rd party programs that's meant to exploit the game as these can sometimes be a vendor for malware, not to mention that it could also result in the loss of items/weapons/your account.
If your account does become compromised, you should contact WoW's support ASAP.
That's all the advice I can really give.