This probably has very little to do with buying gold. Most gold sellers want your repeat business so would be unlikely to go around hacking accounts, plus they can mail you the gold so why would they need your account details. Just to remind everyone though - never give out your account details to anyone.
Question is, do you want your gold more than your repeat business? If it's a choice between paying an employee to farm for days to build up the gold, or nick it from your account, it's probably more profitable for them to nick it and take the chance you won't come back. With 10 million subscribers they probably need gold more than repeat business.