When the slim 360's came out, I traded in my white 20gb model without the hard drive. I assumed that all profile/gamertag information was on the hard drive.
Fast forward to today and I see that someone logged into my account, spent my points, played a game, changed the avatar, etc.
I was not the victim of any social engineering, etc. The only thing I can think of is that my old console allowed the purchaser to log into my XBL account, even though I still have my original hard drive.
Is this possible?