My password was 20ish random characters - upper case letters, lower case, and numbers. After the first time it was drained I switched it to 120ish characters - random words, numbers, and symbols. Both would have been close to impossible brute force as far as I know.
As I said before when you visit the my wallet page and enter the wallet identifier you are served an encrypted copy of the wallet. Then you can take your sweet time brute forcing it offline using GPU farms. Once you successfully do that you have access to the private keys and can spend the coins sent to the corresponding addresses at will. So a) they brute forced your wallet when you had a weak password on it. Maybe they managed it when you had the 20 character password maybe earlier than that. b) If you reused addresses from when you had a weak password they could spend the coins sent to those addresses because they had the decrypted private keys. Adding a stronger password does not protect you from private keys that were stolen in the past.
Another possibility is that you have a key logger on your system i.e malware.
