i still think that this is just a software glitch especially with forwarding, because someone had to either hack into your computer or router and if so, you have bigger problems than just a miner.
also, when you say...stole a miner...do you mean that your miner seized to hash to your pool and was hashing to another address?
if yes, then it was hacked (unless it defaulted to factory settings), if no, then just a software glitch.
To my understanding the OP port forwarded his miner so that he could access it and check on it from anywhere. All it would take for someone to hijack the miner would be to log in with the default credentials ( root/root ) and then they could change anything they want.
The OP wasn't able to login to his miner since the default login would have been changed by the person who hijacked it. I don't think it's a software bug, if there was a bug like that in the firmware I suspect we would have heard about it already, and have others complaining about similar issues, but I think the fact that the OP mentioned that it was port forwarded and using the default logins is a dead giveaway that it was hijacked and the login details were changed.