Thanks for the insider info. One question I have though is if they did have access to my account and are able to change addresses after an order is made online, why not go for the gusto and make really expensive orders using my on-file credit card numbers instead of just doing replacement items?

In any case, I've changed both my password and my email address on Amazon, so if they did have access to the account that should solve that issue for now. The whole situation has made me paranoid enough that I'm considering creating a locked-down custom VM used solely for Amazon shopping.