If they are getting it from mtgox db leak I'd be even more worried that once they figure your SR account they can now most likely tie you to your real identity. Thats alot worst than losing some BTC IMO. :( But ya its prob from phishing scam at this point... Sucks people are still falling for it.