It was reported in T-Mobile's systems as my personal visit, with supporting documentation/ID, to one of their retail locations in Oklahoma – thousands of miles from anywhere I'd recently been. So, while remotely possible that their employee gullibily-reviewed credible false documents, it seemed far more likely to be:…
- an insider abuse by a corrupt employee;
- a deep hack of T-Mobile's systems, allowing such admin actions with forged audit-trails; or…
- compromise of an authorized employee's credentials plus access to capable internal-system front-ends.
The Apple Support person I spoke to insisted that an analogous compromise here was impossible - that no Apple employee had the power take such an action without my Apple ID password. Based on other reports in this thread, I highly suspect she was lying to me, probably in conformance with Apple policy.
"If you need help removing Activation Lock and have proof of purchase documentation, you can start an Activation Lock support request."
The thieves figured out you just need to know (or be) an employee of any of the 500+ Apple stores. I assume that some theft rings have this process quite streamlined.