The cause of the compromise is not described in detail in Twitter’s email — it just says “Twitter believes that your account may have been compromised by a website or service not associated with Twitter”.

Yikes.