I have heard that it has happened before, but rarely. It is probably not a case of hacking but rather that they used a computer that someone else has access to, and didn't log out properly or didn't delete cookies (?). The computer will have remembered the user name & pass, and anyone could have retrieved this and accessed the account. Jolly bad luck though.
I guess my first question would be to wonder what kind of password she/he had in the first place - how secure it was. Any deviation of a their RHP nickname would be a no-no or any of the standard fair. Its surprisingly easy to break into password accounts knowing just a little of the person who created it (family members names, pet names, birthdays, etc).