So what do you do if this happens to your account? Follow these simple steps:
1) Login to your account on Twitter.com
2) Click "Settings"

3) Click "Connections"

4) Revoke access to everything listed here unless you are 100% sure you want it to have access to your account.

5) Click "Password"

6) Change your password - choose a complex password!
7) as a courtesy to your followers, send a quick tweet letting them know NOT to click on the links you had sent out.
Always be aware of what sites and applications are asking for you to log in with your Twitter username and password - be very clear on why that site wants it and what it will do. The only authorized connection I have is TwitterFeed - this service will automatically post a pre-formatted tweet when I have updated this blog. When the Shorty Awards were happening, I granted them access for a day or so, and then revoked it. Sometimes you may not realize that you have granted access to your twitter feed - go in every once in a while and see what is listed under Connections.