The website domain listed on the purported e-mails that players have received, mentioned in the last blog post IS the Square Enix North American support web domain.
The website they post is:
and support.na.square-enix.com IS the North American support web domain.
So this almost certainly means someone got in to the registration server, and several passwords have had to be reset.
(This, probably, also might explain the double-billing -- as my bank explained to me, they look for "out of pattern" situations -- the single billing to Square-Enix on that date is not out of pattern, even with the World Transfer thrown in. A double billing, OTOH...)