Seems pretty fucked. Freeze your card ASAP if you can and try and open a ticket if you can't reset login info with your email. Also try and scan your PC for shit. I use Avast, but there are probably better ones out there, idk.
Though when this happens, it typically locks the account so the other person can't access (unless he has your email info). This could just be a bug on Blizzard's part, but you should take it seriously.
Also I use paypal with my transactions and typically unlink from the account it after each purchase.