Yeah, that's why I'm having to think at it some to figure out what's going on here. Usually I need my iCloud password to do anything related to that account, so I guess they're using some kind of iCloud password reset bypass that relies on the phone having access to necessary reset-related accounts (like email—though, IDK, I don't think I've ever tried to "lost password" reset my iCloud account, so I'm not sure if even that's enough)

You got lucky with dumb thieves.

> she immediately wiped it remotely > She was one of those that saw her device head to Asia

What, the guy just jumped into the Pacific and started swimming?

I believe “She” here refers to the original owner (the victim). Apple offers a feature to remotely wipe your device if lost, and that was what I understood the owner to have done. I’ve done the same thing for a stolen iPhone.

She watched its location using Find My on her laptop. It was last pinging her somewhere just north of Hong Kong (in fact it says: "Montery Plaza, 9 Chong Yip St, Kwun Tong, Kowloon, Hong Kong SAR, China").

Some thieves will force you to give up the passcode.

I’ve read a couple stories where someone was held in an alley while an accomplice went to an ATM to withdraw as much cash as they could.