I believe you got hacked. Perhaps you shouldn't have shared the link with the token included.