if they are smart and have av, but would always start a av-scanned tool:
you could make a real small trojan, that can only connect and download and execute. than u connect, upload subseven and start it. dont know what about the av when u puload and execute but i think u could make it not beeing detected.
u could also try to make a [insert boss-name here]-bot that sends acc + pw to you, well, if he isnt THAT smart.
another thing: brute force. i font know about that really, becos its still that u transfer cd key, version etc.. to the battle.net to connect and u dont get stuff like 500, 401 etc. just no connection to the battle.net. i dont know how real "hackers" as someone would call them that can definately steal someones account by brute force do that but i think it could be possible that they use something like a password-type-bot that trys a long list of passes just in normal d2 bnet logon screen. problem: battle.net wont let u log in to that account if u try like 5 times a wrong pass and then ur ****3d up. i also dont know if there are really like 1337 guys out that can get accounts in a way like that, but well.... have nothing more to say