There's really not much else to say. I'm rather shocked a site used for such purposes as transfer of large amounts of both virtual and real goods does not have such a basic security measure.