I know I was.

 

I used this client in October/2014 and a free varrock rooftop agility script for about 2 days. I quit using it after a 2-day ban and continued about my business for ~2 months before I took a hiatus until now. I logged into my account to see that I had received a Major Macro Ban on Oct 7th, 2015. This is exceptional because I had not logged into my account in so long. I never changed my password after I used this client so this is how they got into my account. It took me taking my case to twitter and submitted 4 appeals with PayPal receipts dating back to 2012 to successfully get my account back. When I was able to log in, my character was in Lumbridge with ranging gear and blue dragonhides in my inventory. ZERO coins in bank (I didn't have that much to begin with). I'm not sure what my range was before but I'm confident that's the only skill they botted on.

 

Please be extremely cautious with this software and open-sourced content.

OSBot only stores your account info locally, nobody can attain your info unless you give it to them. You were either phished elsewhere, contracted a virus, or your friend did it.  Your ban was a delay ban, they are common.

In addition; the extra-paranoid can use a "Default" account which doesn't require your user/pass/pin at all. The details which you do save through OSBot are only stored locally and the files are encrypted.