Stolen Apple IDs and passwords are sold online with the instructions to "buy all you can in 12 hours." This is because it would probably take you at least that long to discover someone was using your credit card. Read more about this scam here.
Here are some things you can (and should) do to protect your Apple ID:
- Use a strong, unique password. (info here) To manage your strong passwords, consider using one of these tools.
- Beware of phishing. (What phishing is) Apple will never email you and ask for your password or credit card number.
- Remove the credit card from your Apple ID entirely. Although Apple really wants your credit card number, you don't have to provide it. iTunes credit gift cards are available almost everywhere. If you only keep $25 or $50 in your account, your loss is limited if the account is compromised. (Most gift cards say "iTunes" but you have one account and one balance at the iTunes Store, Mac App Store, App Store and iBookstore.)