If it wasn't a phishing address, then it sounds as though someone has your password and PIN ... that's the only way they'd be able to transfer bitcoins out of your account.