This is a little mysterious because none of the articles have addressed the exact vulnerability that enables thieves to do this. I've heard a news report suggest "changing your password". This is curiously interesting.
The real problem seems to be with the lack of rate-limiting of the auto-reload feature.