WordPress Admin Password Being Changed/Hacked

I’ve had 2 blogs within the past few weeks that have had the admin password reported as “lost” and then changed. The blogs have then been defaced.

I’m running WP 2.5, any ideas on how this is being done and what I can do to prevent it from happening again?

Thanks in advance everyone…