The last few times this was reported it turned out that the users had opened a port in their internet router to provide direct access to openHAB. So anyone in the world could type in their IP address and fiddle around with switches.
Checkout Shodan to see how many openHAB instances are directly open to the internet!
How have you configured remote access to openHAB, if at all?