WP Affair: Runescape - Intro to Identity Theft?

From my time away on Wordpress.com:

Does anyone else have any experience, good or bad, with Runescape.com?

Runescape is an online interactive adventure game. My kids have been obsessed with Runescape for the better part of a year, jumping online to play with their friends at almost every given opportunity. Because it is online, with hundreds of thousands of players, there are absolutely security risks and exposures, which we considered and monitor closely in allowing our children to play.

There are also benefits:

1. It is educational, with the theme of a medieval quest, which encourages players to explore, acquire new knowledge, to barter and exchange and work together.
2. It is cooperative play -- a rare thing that my children can do and enjoy together, without bickering and fighting. I'd like to think they are watching out for each other, and I think they do, to some extent, when the oldest (age 12) isn't forcing the younger two (ages 9 & 6) to work for him on some conquest or project. (We're working on anti-slavery and fairness concepts, another valuable educational opportunity.)
3. It is non-violent and a fairly clean environment.

We've kept an eye on it, with the computers in our living room and study, out in the open, where we can look over the shoulder anytime and see what's going on, what they are reading and writing, who they are interacting with, as they play in this alternate universe.

They all know the rules of computer and Internet safety, with the primary command of NEVER sharing any personal information; never engaging in any conversation outside the game; telling us about any type of strange behavior, conversation or approach from other players -- anything that confuses them or makes them uncomfortable.

Up until now, we thought it was non-predatory and safe.

The problem we have now is, in two instances, the kid's accounts have been "hacked" -- where they have worked to build something, or collect objects and treasure, or reach higher levels in the game, and all of a sudden discover they can no longer log on to their own account, that someone else has taken over their Runescape identity.

We have not heard back yet from the admininstrator of Runescape.com, and we are following up. At this point, we will be cancelling the kid's registered accounts and they will not be able to play on the member levels, which leads to some pretty unhappy kids.

I'm sad, too, that there are no safe places to play, or work, or do anything else in Cyberspace, and sad, but not ignorant or naive, that our children must learn this reality from the start.