Account Security

This afternoon I checked my e-mail and found I had two different requests within five minutes to change my password...thankfully whoever did this failed and I was able to change my password before they got to my account, but honestly how are we supposed to protect our accounts from this kind of nonsense? If all it takes for people to try and take my account is my user name, I'm not seeing how I can protect my account from people that want to try and take it.