MultiBit should be fine...... I use it on a Linux machine (with a 30+ character password) - I can't really see how someone could make transactions from your wallet without physical access to your PC or unless it has been compromised in some way..... What OS are you running? And are you sure the payout address wasn't altered somewhere else - ie. on the miner or in your ckpool settings.....

What kind of mining hardware and wallet are you using? As has been mentioned previously it's probably not a good idea to be re-using passwords.... If you are using any cloud / rented hashing power be sure not to enter your ckpool password there either, you can point rented miners at the pool without using your account password.