unexplained changes to .Xauthority file entries

I am seeing magic cookies being altered in my .Xauthority file.
File permisssions are daf daf -rw------. The file is created
anew each time kde is started from console mode. I find at the
same time that the magic cookie has been changed that there
is a new socket belonging to me created in the /tmp directory.
I am the sole user (except for hackers) of this system.
I'm currently running 64-bit 3.9 release.

Any ideas how my .Xauthority file is being hacked?

Thanks,
Dave Feustel

.