Remember to check

Remember to check your facebook/runescape account associations before and after EVERY transaction involving someone else having access to your account.

This method was recently highlighted in the suggestions forum and makes your accounts very liable to being raided, they dont even need your Runescape password to do it, just as long as they've used your account at least once to associate with it.

A way of preventing this is doing it yourself or making sure its not associated after EVERY transaction such as an upgrade or service performed on your RS account, or even bought accounts.