I don't know how.. Or when... But for november I am seeing campaigns (and HUGE cost!) in my account that I personally never ran. I notified adwords support of the issue, but would like to know what more steps I can undertake besides changing login information. I am obviously not intent on ever paying for these ads, as they are likely the result of some form of phishing or hacking...
How does google handle this kind of situation?