That's so awful, but I hear Blizzard is really good about handling phishing and hacking. I keep getting emails, messages, and whispers from people trying to phish my account. I don't know why all of a sudden that's become all the rage, but Blizzard's even changed that to the login notice.
Which reminds me, don't submit a ticket for people who whisper you asking you to log in from any websites! I did that, they sent me a message saying they would deal with it but that it's much faster to right-click on the name of the person who whispered you as it immediately links them to that account and they can then ban the IP more easily (which would also prevent them from logging in on other accounts!)