At 6:30am this morning, I apparently reset my http://minecraft.net account password.
Except I was asleep.
The password used was complex, unique to the site, and not dictionary-attackable. It was only 8 characters, but @Mojang should see online brute force attacks, surely.
Thank you for reaching back out! We appreciate your patience as we work through our pending requests, and I hope we can help you determine the cause of the unknown activity with your account very soon. ^SA