Scammed

I have had the most worrying day indeed. The day itself was nice. We went out to dinner with my sister in law's Taiwan relatives. They were lovely. Then me and Danz hit the garden. Planted bedding plants, mowed the lawn and dug up mud. I am knackered! But really good.
No the problem was eBay.
This morning I got an email from a guy asking if the mobile phone I was selling could be posted to London.
Hmm I thought. Strange (not selling anything atm) but must be a crossed email.
Then I get an email from eBay thanking me for changing my email address.
Warning bells rang and I reread the first email and tried to access my account. At first I got in.
I found two items for sale on my account I hadn't placed. Two lots of ten mobile phones. Top of the range with a 24 hour auction and starting price of 100 pounds. So there's at least 2 grand straight away.
I followed the eBay scamming instructions and cancelled those sells but infront of my eyes as I was cancelling those, two more popped up. This time with 20 mobile phones for sale on each. Then they must have changed my password and I couldn't access the account at all.
I emailed eBay and got this reply.

It appears your account was taken over by a third party, and used to place several unauthorised listings. Additionally, the email address on your account may have been tampered with, which is why you may not have received an email about these listings. We have restored your eBay account at this time.

But imagine if I'd gone away and not checked my account or emails. They'd have got away with thousands.
I was a bit freaked but later became even more freaked. I got an email from eBay.

Verify your identity.

Dear eBay member,

All information is required and is kept confidential in accordance with our Privacy Policy.

Due to recent activity, including possible unauthorized listings placed on your account, we will suspend any activity on your account in order to allow us to investigate this matter further. If you believe that this action may have been taken in error, or, if you feel that your account may have been tampered with, please respond to this message so that we can provide additional information and work with you to resolve this issue. Go to link below and login to your account:

It then asked me to supply my full details. Including stuff like bank details, card numbers, pin numbers, number I use to get money from cash machines.
Now my mate Steve has always told me that eBay will NEVER ask for bank details via email. So I didn't fill anything in. But you know what has upset me? That their little scam didn't work so they immediately tried to rescam me.
How did they get my eBay password in the first place? I don't feel secure online anymore.