Yea the amount of people that use the same passwords for different accounts is big.
Take for example the multiplayer list. I bet some people on that list used the same password that they would on there on other places. So you could easily have a d3 forum and advertise on battlenet forums and people sign up with same details and you just harvest all their accounts.
But what i don't understand is how would someone transfer teh gold out of someones account to their own?
They probably transfer it to someone else using the player trade in-game.