Recently I noticed that one of my trusted customers was downloading all extensions he had a subscriptions for. No issue there, but I noticed that the download originated from an Iranian IP Address.
I contacted my customer by email and asked him if it was him who was doing the downloads: it turned out that he wasn't the person logged in!
The username and password that he used on my site (and that he also used on other sites) was compromised.