In order for anyone to transfer btc on SR, they would need your PIN. Are you sure you haven't entered it anywhere? Because at this point, you're saying someone knew your password AND your PIN ... which would be difficult for anyone to guess.