Make Account Passwords be Case Sensitive.

That's pretty old-school and helps with brute force attacks. That's not the way they get hold of WoW accounts.

Malware and social engineering, followed by people reusing passwords on everything are the main causes. If you play a another game, or register on a website and use the exact same email and password and they get their hands on it they ARE going to try it to see if you have a WoW account. Many very very old accounts get into malicious hands in just that way.