>> Well, If he had a backup (either remote or local) it wouldn't have mattered.

For this specific thing, no. But this was a fairly blatant act by the hacker. What if they silently read your iCloud mail, or used the Find my iPhone functionality to stalk you.

They couldn't silently do anything. They won't give you passwords, they give you the ability to reset it. If the hacker were to reset it, the reporter would notice (as he wouldn't be able to use his account anymore). And I think Find my iPhone would cease working if the password saved by the app does not match what's stored in the cloud (i.e. hacker's bogus password).

In case of cookie sniffing, Google shines. They show you the IP addresses of people who have used your account recently. If you (or them) spot an stalker, you can reset the password. I don't know how effective that could be with 3G, but at least

---

That said, It's no secret that Apple's password system is absolute garbage. I had to reset it 5 times last month because someone was trying to get to my iCloud account (probably brute-force). Apple would de-activate my account and would require me to re-enter security questions and choose a "new" password that I haven't used in the past year. And every time I had to spend an hour typing the new password in my various devices. AND I WOULDN'T RECEIVE MAILS IN THE MEANTIME. Just ridiculous.