This morning I received 3 email notifications from NCL confirming upgrade bids for an upcoming cruise that I didn't request. Each of the 3 bids were for the same dollar amount. Luckily, the bids were still in a pending status and I was able to cancel each from the emails I was sent this morning.
I contacted NCL support and they concluded the requests were made outside of NCL's system - which means somehow my profile has been hacked. I changed the password just to be sure.
Everyone - be aware, if you see any bids for upgrades you didn't request, be sure to cancel them right away. NCL was not any help in determining how this happened.
I would also suggest to update your password if you haven't done so in a while.