Sounds like there's some pretty nifty malware out there recently http://www.reddit.com/r/Bitcoin/comments/1sxcyr/coinbase_acc... https://bitcointalk.org/index.php?topic=355045.0

Perhaps something to do with the API (which is disabled by default but some victims have noticed was enabled) https://coinbase.com/docs/api/authentication "If someone obtains your api_key or an access_token with the send or all permission, they will be able to send all the bitcoin out of your account."

(edit: followed the transaction trail on one of those links, ended up with week old address that had received 49,497BTC https://blockchain.info/address/1Facb8QnikfPUoo8WVFnyai3e1Hc...)