I also don't have sufficient proof. It was done via PMs and no screenshots were taken.
I wasn't aware that my password could be given out without me actually sending it to someone or clicking a malicious link.
The only sites I visited was sythe and runescape, so I'm not sure how he got my password.