Most people who claim to get "hacked" actually havent gotten hacked at all. Chances are that one of their friends guessed the password because it was too easy, they gave the password out, or they used it on multiple sites and told their friend the password to another site which uses the same pass as runescape. Anyone who is actually capable and willing enough to hack most likely has better things to get passwords for than a runescape account, and if they did, it would be to zezimas or one of the top players. If hackers wanted a password, they would be smart to try and get your paypal pass if anything.