I've been using OSBot since 2013, OSBuddy since it was RSBuddy back in the day without any issues at all on any of my accounts.
Let me just tell you this. Its easy to bruteforce/crack accounts nowadays. I know from experience. Hackers don't even need your runescape login info, they might have got it from a complete different site & doesn't even have to be runescape related. Heck your email/user might just have been leaked from any site you've been using for the past few years. Over 1,000,000 username/password list can be run within few hours.
Don't go and throw bricks at OSBot for that. If they wanted to hack our accounts they sure wouldn't go after people with bread crumbs on their accounts.
My thought here is either its your friend again since he did it once already or you just got randomly hacked, someone somewhere got lucky with their password-list. My suggestion is that you go and google LastPass and make sure you use that program for your passwords in the future.